Authorities

The Authorities page lets you create and manage certificate authorities (CAs) for your Private SSL infrastructure. Each CA can sign certificates and maintain its own certificate revocation list (CRL).

Authorities list

Navigate to Operation → Private SSL → Authorities to view all certificate authorities.

The list shows:

Name: CA name with status badge (Active, Initializing, Error, Inactive)
Organization: Organization name
Domain: Root certificate domain
Server: Server running the CA plugin
Root valid for: Root certificate validity period
Child valid for: Default and maximum validity for signed certificates (e.g., “365 days (default) / 730 days (max)”)
Signed at / Expires at: Certificate timestamps
Owner: CA owner
Connected: Whether the CA server is currently connected

Creating a certificate authority

Click New certificate authority
Configure the CA settings:

Field	Description
Name	Common name for the CA (e.g., “My Company Root CA”)
Organization	Your organization name
Domain	Domain name for the root certificate
Root valid days	Root certificate validity (default: 3650 days / 10 years)
Default valid days	Default validity for child certificates (default: 365 days)
Maximum valid days	Maximum allowed validity for child certificates (default: 730 days)
Key algorithm	RSA or ECDSA
Key size	2048 or 4096 bits (RSA) / 256 or 384 bits (ECDSA)
Server	Server to run the CA plugin
Owner	CA owner (administrator)
Automatic installation	Automatically install the CA plugin on the selected server

Click Create

The CA will be initialized on the selected server. This may take a few moments.

Authority detail page

Click on a CA name to view its details:

Information displayed:

Organization, Domain, Server
Connectivity status
Owner and Status
Validity information (root and child certificates)
Key algorithm details
Error message (if the CA encountered an error)

Available actions:

Download .crt: Download the root certificate
Download .crl: Download the certificate revocation list
Restart plugin: Restart the CA plugin on the server
Upgrade plugin: Upgrade the CA plugin to the latest version
Edit: Modify CA settings
Delete: Remove the CA and all associated certificates

Tabs:

Certificates: View all certificates signed by this CA
Expiring soon: View certificates that will expire soon

Downloading certificates and CRLs

Root certificate (.crt)

Clients need the root certificate to verify certificates issued by your CA.

From the web interface:

Go to Authorities → select a CA
Click Download .crt

From the CLI:

alpacon authority download-crt AUTHORITY_ID -o ca-cert.pem

Certificate revocation list (.crl)

The CRL contains revoked certificates. Distribute this to clients for revocation checking.

From the web interface:

Go to Authorities → select a CA
Click Download .crl

From the CLI:

alpacon authority download-crl AUTHORITY_ID -o crl.pem

CA statuses

Status	Description
Active	CA is running and can sign certificates
Initializing	CA is being set up on the server
Error	CA encountered an error (check plugin logs)
Inactive	CA is stopped or disabled

Managing authorities

Editing a CA

Go to the CA detail page
Click Edit
Modify settings and save

Deleting a CA

Go to the CA detail page
Click Delete
Confirm deletion

Deleting a CA invalidates all certificates it has issued. Ensure no services depend on these certificates before deleting.

CLI commands

Command	Description
`alpacon authority ls`	List all certificate authorities
`alpacon authority describe AUTHORITY_ID`	View CA details
`alpacon authority create`	Create a new CA
`alpacon authority update AUTHORITY_ID`	Update CA settings
`alpacon authority delete AUTHORITY_ID`	Delete a CA
`alpacon authority download-crt AUTHORITY_ID`	Download root certificate
`alpacon authority download-crl AUTHORITY_ID`	Download CRL

Requests - Managing sign and revoke requests
Certificates - Viewing issued certificates
CLI reference: alpacon authority - Full command reference