ezgh private-ca ca create --name <name> --type root|subordinate [--parent <ca> | --external] [--key-algorithm a] [--common-name cn] [--wait] [flags]Create a certificate authority. Its key is generated by EZGH and never leaves it.
--type root makes a self-signed root, which signs only subordinate CAs. --type subordinate makes a CA signed by --parent (a CA in the project, by name, slug or ID; needs certificates.certificateAuthorities.issue on it), or, with --external, by your own root: it waits for its certificate (ezgh private-ca ca csr, then ezgh private-ca ca import).
The subject (--common-name, default the name; --organization, --organizational-unit, --country), key algorithm, path length, name constraints and validity are fixed once it’s created. Roots are valid 365–9132 days (default 3650), subordinates 365–3653 (default 1825, never past their parent). --max-leaf-validity-days (subordinates, 1–825, default 90) can only be shortened later.
Creating takes a few seconds; --wait waits for it (at most --wait-timeout, 10 minutes by default) and prints the CA once it’s active.
Part of ezgh private-ca ca.
Examples
ezgh private-ca ca create --name corp-root --type root --key-algorithm ecdsa-p384 --common-name "Corp Root" --wait
ezgh private-ca ca create --name corp-issuing --type subordinate --parent corp-root --permitted-dns corp.example --wait
ezgh private-ca ca create --name corp-ext --type subordinate --externalFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--common-name |
string | the subject’s common name (default: the name) | |
--country |
string, repeatable | the subject’s two-letter country (C) | |
--description |
string | what it’s for | |
--excluded-dns |
string, repeatable | a DNS name or .domain its certificates may not hold (repeat) | |
--excluded-email |
string, repeatable | a mailbox, host or .domain email names may not be in (repeat) | |
--excluded-ip |
string, repeatable | a CIDR range its certificates’ IP addresses may not be in (repeat) | |
--excluded-uri |
string, repeatable | a host or .domain URI names may not be on (repeat) | |
--external |
boolean | a subordinate signed by your own root: import its certificate later | |
--key-algorithm |
string | ecdsa-p256 |
ecdsa-p256, ecdsa-p384, rsa-2048, rsa-3072 or rsa-4096 |
--max-leaf-validity-days |
int | 90 |
the longest certificate it issues, 1–825 (subordinates) |
--name |
string | its name (required) | |
--organization |
string, repeatable | the subject’s organization (O) | |
--organizational-unit |
string, repeatable | the subject’s organizational unit (OU) | |
--parent |
string | a subordinate’s parent CA in the project, by name, slug or ID | |
--path-length |
int | CA levels allowed below it: roots -1 (any) to 2, default 1; subordinates 0 to 2, default 0 | |
--permitted-dns |
string, repeatable | a DNS name or .domain its certificates may hold (repeat) | |
--permitted-email |
string, repeatable | a mailbox, host or .domain for email names (repeat) | |
--permitted-ip |
string, repeatable | a CIDR range its certificates’ IP addresses must be in (repeat) | |
--permitted-uri |
string, repeatable | a host or .domain for URI names (repeat) | |
--type |
string | root or subordinate (required) | |
--validity-days |
int | its certificate’s validity (default: 3650 for roots, 1825 for subordinates) | |
--wait |
boolean | wait until it’s created, and print it then | |
--wait-timeout |
duration | 10m0s |
how long --wait waits |
This command also takes the global flags.