---
title: "ezgh private-ca ca create"
description: "Create a certificate authority."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca ca create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca ca create --name <name> --type root|subordinate [--parent <ca> | --external] [--key-algorithm a] [--common-name cn] [--wait] [flags]
```

Create a certificate authority. Its key is generated by EZGH and never leaves it.

`--type` root makes a self-signed root, which signs only subordinate CAs. `--type` subordinate makes a CA signed by `--parent` (a CA in the project, by name, slug or ID; needs certificates.certificateAuthorities.issue on it), or, with `--external`, by your own root: it waits for its certificate (`ezgh private-ca ca csr`, then `ezgh private-ca ca import`).

The subject (`--common-name`, default the name; `--organization`, `--organizational-unit`, `--country`), key algorithm, path length, name constraints and validity are fixed once it's created. Roots are valid 365–9132 days (default 3650), subordinates 365–3653 (default 1825, never past their parent). `--max-leaf-validity-days` (subordinates, 1–825, default 90) can only be shortened later.

Creating takes a few seconds; `--wait` waits for it (at most `--wait-timeout`, 10 minutes by default) and prints the CA once it's active.

Part of [`ezgh private-ca ca`](/cli/reference/private-ca-ca).

## Examples

```sh
ezgh private-ca ca create --name corp-root --type root --key-algorithm ecdsa-p384 --common-name "Corp Root" --wait
ezgh private-ca ca create --name corp-issuing --type subordinate --parent corp-root --permitted-dns corp.example --wait
ezgh private-ca ca create --name corp-ext --type subordinate --external
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--common-name` | string |  | the subject's common name (default: the name) |
| `--country` | string, repeatable |  | the subject's two-letter country (C) |
| `--description` | string |  | what it's for |
| `--excluded-dns` | string, repeatable |  | a DNS name or .domain its certificates may not hold (repeat) |
| `--excluded-email` | string, repeatable |  | a mailbox, host or .domain email names may not be in (repeat) |
| `--excluded-ip` | string, repeatable |  | a CIDR range its certificates' IP addresses may not be in (repeat) |
| `--excluded-uri` | string, repeatable |  | a host or .domain URI names may not be on (repeat) |
| `--external` | boolean |  | a subordinate signed by your own root: import its certificate later |
| `--key-algorithm` | string | `ecdsa-p256` | ecdsa-p256, ecdsa-p384, rsa-2048, rsa-3072 or rsa-4096 |
| `--max-leaf-validity-days` | int | `90` | the longest certificate it issues, 1–825 (subordinates) |
| `--name` | string |  | its name (required) |
| `--organization` | string, repeatable |  | the subject's organization (O) |
| `--organizational-unit` | string, repeatable |  | the subject's organizational unit (OU) |
| `--parent` | string |  | a subordinate's parent CA in the project, by name, slug or ID |
| `--path-length` | int |  | CA levels allowed below it: roots -1 (any) to 2, default 1; subordinates 0 to 2, default 0 |
| `--permitted-dns` | string, repeatable |  | a DNS name or .domain its certificates may hold (repeat) |
| `--permitted-email` | string, repeatable |  | a mailbox, host or .domain for email names (repeat) |
| `--permitted-ip` | string, repeatable |  | a CIDR range its certificates' IP addresses must be in (repeat) |
| `--permitted-uri` | string, repeatable |  | a host or .domain for URI names (repeat) |
| `--type` | string |  | root or subordinate (required) |
| `--validity-days` | int |  | its certificate's validity (default: 3650 for roots, 1825 for subordinates) |
| `--wait` | boolean |  | wait until it's created, and print it then |
| `--wait-timeout` | duration | `10m0s` | how long `--wait` waits |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/private-ca-ca-create/index.mdx