After you enable a private CA , you can issue private certificates through a subordinate CA for identity authentication and data encryption and decryption in internal enterprise applications. This topic describes how to purchase, assign, request, download, install, and revoke private certificates.
Background
Private certificates (end-entity certificates) include server certificates and client certificates. They can only be issued by private subordinate CAs . After you install the corresponding private certificates on both the server and the client, trusted encrypted communication can be established between them.
Get started
When you configure private certificates for the first time, follow this flow:
Prerequisites
You have purchased and enabled a private CA . For more information, see Purchase and enable a private CA .
Purchase private certificates
If the certificate resources included with your root CA are insufficient, you can purchase additional certificates to increase the total number of certificates that all subordinate CAs under that root CA can issue.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose . On the Private Certificate Management page, select the region where the PCA service is located.
On the Private CAs tab, locate the target root CA. In the Actions column, click Purchase Certificate.
In the Purchase Certificate panel, enter the number of certificates to purchase, and click Purchased to complete the payment.
NoteFor a single root CA, if the cumulative number of purchased certificates exceeds a specific threshold, the fees for certificates beyond that threshold are waived. To learn the exact threshold, contact your account manager.
Assign private certificates
A root CA cannot directly issue certificates. You must first assign certificate resources from the root CA to a subordinate CA. Before assignment, both the root CA and the subordinate CA must meet the following conditions:
Both the root CA and the subordinate CA are in the Enabled state.
The remaining certificate count of the root CA is greater than 0.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose . On the Private Certificate Management page, select the region where the PCA service is located.
On the Private CAs tab, locate the target root CA. In the Remaining Certificates column, click Assign Certificate.
In the Assign Certificate panel, select the target subordinate CA, set the Remaining Certificates value, and click OK.
Request private certificates
You can request private certificates from a subordinate CA only when its Remaining Certificates value is greater than 0.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose . On the Private Certificate Management page, select the region where the PCA service is located.
On the Private CAs tab, locate the target subordinate CA. In the Actions column, click Apply for Certificate.
In the Apply for Certificate panel, configure the certificate details and click Confirm.
After you submit the request, private CA certificates are issued immediately . After a private certificate is issued, you can click Certificates in the Actions column of the subordinate CA to view the issued certificates on the Certificates page.
Server Certificate: Install on your application server for server-side identity authentication.
Client Certificate: Install on clients for client-side identity authentication.
If the service duration is less than one year, the certificate validity period cannot exceed the purchased PCA service duration. For example, if you purchase a one-month PCA service, the maximum certificate validity period is 31 days. To extend the validity period, renew your PCA service. For renewal steps, see Renewal policy.
If the service duration is one year or longer, the supported certificate validity period ranges from 1 to 100 years.
If the certificate needs to apply to multiple subjects, add other subject information using the SAN extension.
For server certificates, enter domain names or IP addresses. For client certificates, enter email addresses or URIs.
You can add up to 10 SAN extensions.
Configuration item | Description |
Certificate Type | |
Common Name (CN) | The Common Name of the certificate subject. |
Validity Period | The validity period of the private certificate. The validity period depends on the service duration of your subordinate CA: |
SAN | The SAN extension property of the private certificate, used to apply the certificate to multiple subjects. Note SAN (Subject Alternative Name) is an extension field defined in the X.509 standard that allows a single certificate to support multiple domain names. A URI (Uniform Resource Identifier) identifies the Alibaba Cloud resource associated with the certificate, such as the Elastic Compute Service (ECS) instance where the private certificate is deployed. |
More | To add certificate name, company, or department information to the certificate, click More. |
Include CRL Address | Enabled by default. For more information about CRL, see CRL service. |
Download private certificates
After a private certificate is issued, you can download it and distribute it to the corresponding entity for installation.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose . On the Private Certificate Management page, select the region where the PCA service is located.
On the Private CAs tab, locate the target subordinate CA. In the Actions column, click Certificates.
On the Certificates page, locate the target private certificate. In the Actions column, click Download.
In the Download Certificate dialog box, select the certificate format and click Confirm and Download.
Install private certificates
After downloading private certificates, install server certificates on your application servers and client certificates on client browsers. The installation method for server certificates is the same as for SSL certificates. For instructions, see Deploy SSL certificates.
Revoke private certificates
If you no longer need a private certificate before it expires, you can revoke it.
After you revoke or delete a private certificate, it is no longer trusted in your internal environment and cannot be recovered or re-enabled. Proceed with caution.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose . On the Private Certificate Management page, select the region where the PCA service is located.
On the Private CAs tab, locate the target subordinate CA. In the Actions column, click Certificates.
On the Certificates page, locate the target private certificate. In the Actions column, click Revoke.
In the Confirmation dialog box, click Revoke.
After confirmation, the certificate is revoked immediately. Its Status changes to Revoke. At this point, you can delete the certificate from the certificate list.