Docs Getting started with an Offline Root

Getting started with an Offline Root CA

CertFu supports both online and offline root certificate authorities (CAs).

Online root CAs are easier to setup and manage. Everything can be done inside the CertFu management portal.

In contrast, offline root CAs can enhance security by allowing you to create and store the root CA entirely on your own systems. However, this is quite a bit more complicated.

Online roots are ideal for:

  • Testing out CertFu
  • Development, staging, and QA environments
  • Any organization that doesn’t want to manage an offline root CA

Offline roots are appropriate for:

  • Organizations with a preexisting root CA who are moving to or adding CertFu to their infrastructure
  • Organizations that must have maximum security

The instructions below are for an offline root. Or you may jump to instructions for an online root.

0. Preliminaries

CertFu uses a common 2-layer Root + Intermediate CA configuration. This is what allows you to maintain full control of the root CA while providing CertFu with an intermediate CA keypair which allows CertFu to automatically issue certs.

CertFu supports both RSA and EC keys. When creating new keypairs, we recommend EC unless you have legacy infrastructure that requires RSA.

If you already have both the root and intermediate ready to go, skip to step 1.

If you already have a process for creating these, do that now and then jump to step 1.

If you’ve never done this before, a basic example using the openssl cli tool is shown below. There are also tools like easyrsa, but those are beyond the scope of this document.

a. Creating a local root CA keypair

Create the root key.

openssl genpkey -algorithm EC -pkeyopt group:secp384r1 -out rootca1.key
Next, create the self-signed root cert. Here the root CA is named `MyOrg Root CA 1`. Change this as appropriate. 
openssl req -new -x509 -key rootca1.key -sha384 -days 7300 \
  -subj "/CN=MyOrg Root CA 1" \
  -addext "basicConstraints=critical,CA:true" \
  -addext "keyUsage=critical,keyCertSign,cRLSign" \
  -out rootca1.crt
b. Creating an intermediate CA keypair for CertFu

Create the intermediate key. Like above, this stores the .key unencrypted.

openssl genpkey -algorithm EC -pkeyopt group:prime256v1 -out intca1.key

Create an intermediate CSR (certificate signing request). The intermediate CA is named MyOrg Intermediate CA 1. Again, change as appropriate.

openssl req -new -key intca1.key -sha256 \
  -subj "/CN=MyOrg Intermediate CA 1" \
  -out intca1.csr

Sign the intermediate using the root.

openssl req -x509 -in intca1.csr -CA rootca1.crt -CAkey rootca1.key -sha384 -days 1825 \
  -addext "basicConstraints=critical,CA:true" \
  -addext "keyUsage=critical,keyCertSign,cRLSign" \
  -out intca1.crt

1. Add the root CA

Upload the root CA to CertFu. We’re only uploading the .crt, not the .key which remains private to you.

CA Certs -> Add Root CA -> Offline Root

Paste the contents of your Root CA .crt into Public cert. In our example above, this is rootca1.crt. You can leave Name blank. Select Save.

2. Add the intermediate CA

Add the intermediate CA next.

Click on to the right of the root CA. Select Add Intermediate CA.

Paste the contents of your Intermediate CA .key into Private key and the Intermediate CA .crt into Public cert. From our example above, these are intca1.key and intca1.crt, respectively. You can leave Name blank. Select Save.

3. Create a directory

Now let’s create a directory.

Directories -> Add Directory

Add a Name and Path. Note that the Path is globally unique, so you may wish to append -test or similar if this directory won’t be for production. Deleted directories do allow reuse of paths after the system cleans up old deleted records. Try to avoid the word directory in the Path as this will make the final generated path more confusing.

Ensure the Signing cert shows the newly created intermediate CA from step 2. Select Save.

4. Configure each ACME client

Each ACME client needs its own Account key. Clients may obtain an Account key one of several ways:

  • Securely self-provision their own Account key using an EAB token (recommended)
  • Precreate or import an Account key
  • Use open registration (discouraged except in limited circumstances)

Whichever you choose, proceed to Client configuration for the remaining steps.