Getting started with an Online Root CA
CertFu supports both online and offline root certificate authorities (CAs).
Online root CAs are easier to setup and manage. Everything can be done inside the CertFu management portal.
In contrast, offline root CAs can enhance security by allowing you to create and store the root CA entirely on your own systems. However, this is quite a bit more complicated.
Online roots are ideal for:
- Testing out CertFu
- Development, staging, and QA environments
- Any organization that doesn’t want to manage an offline root CA
Offline roots are appropriate for:
- Organizations with a preexisting root CA who are moving to or adding CertFu to their infrastructure
- Organizations that must have maximum security
The instructions below are for an online root. Or you may jump to instructions for an offline root.
1. Create the root CA
Start by creating a root CA.
CA Certs -> Add Root CA -> Online Root
Add a Root CA name and select Save. This name will be referenced in all created certs in the future and cannot be changed, so choose carefully. Examples: MyOrg Root CA 1 or MyOrg Root CA 2026.
2. Create the intermediate CA
Create an intermediate CA next.
Click on to the right of your new root CA. Select Add Intermediate CA.
Add an Intermediate CA name and select Save. Like the root CA name, this name will also be referenced in all future certs signed by this intermediate. This cannot be changed directly, but you can later change it by replacing the Intermediate CA itself. Examples: MyOrg Intermediate CA 1 or MyOrg Intermediate CA 2026.
3. Create a directory
Now let’s create a directory.
Directories -> Add Directory
Add a Name and Path. Note that the Path is globally unique, so you may wish to append -test or similar if this directory won’t be for production. Deleted directories do allow reuse of paths after the system cleans up old deleted records. Try to avoid the word directory in the Path as this will make the final generated path more confusing.
Ensure the Signing cert shows the newly created intermediate CA from step 2. Select Save.
4. Configure each ACME client
Each ACME client needs its own Account key. Clients may obtain an Account key one of several ways:
- Securely self-provision their own Account key using an EAB token (recommended)
- Precreate or import an Account key
- Use open registration (discouraged except in limited circumstances)
Whichever you choose, proceed to Client configuration for the remaining steps.