Docs Using Directories

Using Directories

Directories are the primary top-level concept in CertFu. Most often organizations will use a single directory in production.

Multiple directories

Each directory is matched to one Intermediate CA certificate. Multiple directories can be used to:

  • Sign certs using two or more Intermediate CAs (using the same Root)
  • Sign certs using two or more Root CAs

Potential use cases for multiple directories (and thus multiple certificate chains) include:

  • Separating production from staging/QA/development
  • Better reflecting the organizational structure
  • Already using 2 or more root or intermediate CAs and mirroring this in CertFu
  • Using different Root and/or Intermediate certificate types (EC vs RSA, or different bit lengths)

Directory settings

Unless specified, values may be updated. Some settings are not available on all plans.

Name - A human-friendly name for the Directory. Visible only in the UI.

Path - A globally unique slug used to build the directory URL. May not be changed. Examples: myorg-prod, myorg-mydept-test, etc. Try to avoid the word directory in the Path as this will make the final directory URL more confusing. Deleted directories will allow reuse of paths after the system cleans up old deleted records.

Remote IP whitelist - IP addresses or blocks that are allowed to talk to this directory. Both individual IPs and CIDRs are allowed. Blank = any address.

Registration mode -

  • Preregister - Account Keys must be precreated or new registrations must use an EAB token.
  • Open - New registrations are freely allowed.
    Careful! This can be easily abused. This should generally only be used alongside Remote IP whitelist, Allowed DNS identifiers, and/or Allowed IP identifiers to restrict registration and/or cert issuance.

In both cases, access is still subject to the Remote IP whitelist above.

Signing cert - Which intermediate CA is used to sign new certs. This may be updated to accommodate expiring intermediate certs. However, the updated intermediate must be signed by the same original root CA.

Cert minimum duration and Cert maximum duration - The minimum and maximum durations that a client is allowed to request. Certs that don’t specify a duration default to 90 days (or whatever will fit within the set min/max durations).

Allowed DNS identifiers - Domain names that are allowed in new cert requests. Blank = disallow all DNS names.

  • fqdn.com - Exact match
  • *.fqdn.com - Matches one level: a.fqdn.com, but not b.a.fqdn.com
  • **.fqdn.com - Matches all levels: a.fqdn.com and b.a.fqdn.com
  • ** - Allow everything

CAA tag - When validating CAA DNS records, look for this value in issue and issuewild tags. Default is certfu.com.

On missing CAA -

  • Pass - Allow cert issuance when CAA records are missing.
  • Fail - Refuse cert issuanace when CAA records are missing.

Hint: When an ACME Account Key is set to auto-approve new certs, CAA checks are bypassed, regardless of this setting.

Allowed IP identifiers - IP addresses that are allowed in new cert requests. Blank = disallow all IPs. Both individual IPs and CIDRs are allowed. To allow all, use 0.0.0.0/0 and/or ::/0.