How to Create Subordinate CA

Prerequisites

1. Registering the application in your tenant
2. Selecting a Plan
3. Selecting a Plan
4. Create First Root CA

Video Version

Overview

In this page we will guide you on how you can create your own SSL CA and chain it up to a Root CA (EZCA Root or Offline Root).

Getting Started

1. Go to https://portal.ezca.io/
2. Login with an account that is registered as a PKI Admin in EZCA.
3. Navigate to Certificate Authorities.
4. Click on the “Create CA”
5. Select Subordinate/Intermediate CA.
6. Click Next

Entering CA Information

1. Enter Common Name: This is the name of the CA how it will appear in the certificate.
2. (Optional) Enter CA Friendly Name This is the name that will appear in the EZCA portal, by default we will use the Common Name
3. (Optional) Enter the Organization The Organization field is an optional certificate field that usually has the company name.
4. (Optional) Enter the Organization Unit The Organization Unit field is an optional certificate field that usually contains the unit that runs this CA (For example: IT or HR).
5. (Optional) Enter the Country Code The Country Code field is an optional certificate field that identifies the country where this CA is located.
6. Click Next.

Cryptographic Requirements

1. Unless you have specific compliance or security requirements, leave the default cryptographic values for best security and compatibility.

Validity Period

1. Select your Validity Period Learn more about Validity Period best practices
2. Enter a Notification Email this email address (as well as the PKI Administrators) will get all the notifications for the lifecycle of the CA.
3. Select the lifecycle action you want EZCA to take when expiry of the CA is approaching
4. Select the percentage of lifetime of the certificate when you want EZCA to start taking Lifecycle actions.

CA Certificate Revocation List

1. Select if you want this CA should issue a CRL (Highly recommended)
2. Click Next.

CA Certificate Revocation List Advance Settings

1. Click the expand button
2. Enter the desired CRL Validity Period in days
3. Enter the desired CRL Overlap Period in hours
4. (Optional) Enter the CRL endpoint where you will publish your CRLs

   Custom CRL endpoints are supported by EZCA by adding the CRL endpoint as the CRL endpoint in the certificate. However, your PKI admins are responsible from getting the CRL from EZCA and posting it in that specific endpoint.

5. Click Next.

Issuance Policy

1. Enter the largest certificate lifetime that this CA can issue. EZCA automatically calculates the recommended maximum based on CA lifecycle best practices.

Issuance Policy (Advanced Settings)

1. Click the expand button

Pre-Approved List of domains

1. Since this is not a publicly trusted CA, by default EZCA will allow requesters to register any domains. If you want to limit which domains can this CA issue, Select the “Allow Only Pre-Approved List of Domains” option.
2. Upload a .txt file with your Pre-Approved domains (one per line), or enter them in the portal.

Allow Wildcard Domains

By default EZCA does not allow users to request certificates with wildcard domains (a domain that starts with *. which allows you to use that same certificate for all other subdomains). If you want EZCA to issue wildcard certificates, select the “Allow wild-card certificates” option.

Issuance Rules

To enable more granular control who can request domain ownership in EZCA, we created to extra knobs PKI administrators can adjust to control domain ownership.

1. Require domain registration approval. This option enables PKI administrators to set a group of approvers that must approve each domain registration before a user or group of users are registered as domain owners.

   1. To enable this option select the “require approval” option.
   2. Enter the users or AAD groups that can approve domain requests.

2. The second way PKI administrators can control the registration of domains is to only allow specific users to request domains. This option enables PKI administrators to set a list of users that can request domains for this CA.

   1. To enable this option deselect the “Allow all users” option.
   2. Enter the users or AAD groups that can register domains.

3. Once you are done setting up your issuance policy, click Next.

Select Location

1. Select the location where you want your CA to be created.

Add Geo-Redundancy

EZCA Allows you to create multiple CAs across many regions to create Geo-Redundancy.

1. Click the “Add Secondary Location” Button.
2. Enter the Location information.
3. Add as many locations as needed.

Create CA

1. Click Create.

Chaining to EZCA Root CA

1. Once the CA is requested, a Certificate Signing Request (CSR) will be created for each location.
2. If your desired Root CA is an EZCA CA, Select it from the dropdown and click create CA.
3. Repeat these steps for each location.
4. Your CA is ready to be used!
5. Next step: Register your first domain

Chaining to Offline Root CA

1. Once the CA is requested, a Certificate Signing Request (CSR) will be created for each location.
2. Click the “Save CSR” Button.
3. Once the CSR is download, follow your internal guidance to transfer that CSR to your offline Root CA.
4. Open “Certificate Authority”.
5. Right click the CA.
6. Select All Tasks -> Submit new Request.
7. Select the downloaded CSR.
8. Click on pending requests.
9. Right click on the newly created request.
10. Select All Tasks -> Issue.
11. Click on Issued Certificates.
12. Double click on the newly created certificate.
13. Click on Details.
14. Click on the “Copy ti File…” Button.
15. Click next
16. Select the “Base-64 encoded X.509 (.CER) option.
17. Click next.
18. Select where you want to save the newly created certificate.
19. Click next.
20. Click Finish.
21. This should create a .cer file in the location you selected.
22. Follow you PKI team’s guidance on transferring the certificate file out of the offline CA into an internet connected computer.
23. Once you have the certificate in an internet connected computer, go to https://portal.ezca.io/
24. Login with an account that is registered as a PKI Admin in EZCA.
25. Navigate to Certificate Authorities.
26. Click View details of the CA you want to import the certificate for.
27. Scroll down to the location you want to import, and click the “Upload CA Certificate” button.
28. Select the newly created certificate file.
29. Click on the “Save Certificate” button
30. Repeat these steps for each location.
31. Your CA is ready to be used!
32. Next step: Register your first domain