Authorities

The Authorities page lets you create and manage certificate authorities (CAs) for your Private SSL infrastructure. Each CA can sign certificates and maintain its own certificate revocation list (CRL).

Authorities list#

Navigate to Operation → Private SSL → Authorities to view all certificate authorities.

The list shows:

• Name: CA name with status badge (Active, Initializing, Error)
• Organization: Organization name
• Domain: Root certificate domain
• Server: Server running the CA plugin
• Root valid for: Root certificate validity period
• Child valid for: Default and maximum validity for signed certificates (e.g., “365 days (default) / 730 days (max)”)
• Signed at: When the root certificate was signed
• Expires at: When the root certificate expires
• Owner: CA owner
• Connected: Whether the CA server is currently connected

Creating a certificate authority#

1. Click New certificate authority
2. Configure the CA settings:

3. Click Create

The CA is initialized on the selected server. This may take a few moments.

Authority detail page#

Click on a CA name to view its details:

Information displayed:

• Organization, Domain, Server
• Connectivity status
• Owner and Status
• Validity information (root and child certificates)
• Key algorithm details
• Error message (if the CA encountered an error)

Available actions:

• Download .crt: Download the root certificate
• Download .crl: Download the certificate revocation list
• Restart plugin: Restart the CA plugin on the server
• Upgrade plugin: Upgrade the CA plugin to the latest version
• Edit: Modify CA settings
• Delete: Remove a CA that has never received a certificate request

Tabs:

• Certificates: View all certificates signed by this CA
• Expiring soon: View certificates that will expire soon

Downloading certificates and CRLs#

Root certificate (.crt)#

Clients need the root certificate to verify certificates issued by your CA.

From the web interface:

1. Go to Authorities → select a CA
2. Click Download .crt

From the CLI:

alpacon authority download-crt AUTHORITY -o ca-cert.pem

Certificate revocation list (.crl)#

The CRL contains revoked certificates. Distribute this to clients for revocation checking.

From the web interface:

1. Go to Authorities → select a CA
2. Click Download .crl

From the CLI:

alpacon authority download-crl AUTHORITY -o crl.pem

CA statuses#

Managing authorities#

Editing a CA#

1. Go to the CA detail page
2. Click Edit
3. Modify settings and save

Deleting a CA#

You can delete a CA only if it has never received a certificate request:

1. Go to the CA detail page
2. Click Delete
3. Confirm deletion

Once a CA has received a certificate request, it can’t be deleted. Alpacon refuses the deletion and keeps the CA together with its sign requests, issued certificate records, and revocations, so the history of what it signed stays available.

Retiring a CA with history#

To stop using a CA that has already received requests, delete the server it runs on. The server has to be disconnected first, as that page describes. The CA then leaves the authorities list and is no longer chosen to sign new requests. Its sign requests, certificate records, and revocations are kept, even though the server removal page describes deleting the server’s own data as permanent.

CLI commands#

Related topics#

• Requests - Managing sign and revoke requests
• Certificates - Viewing issued certificates
• CLI reference: alpacon authority - Full command reference