Private CA | EZGH Cloud

Run private certificate authorities and issue the certificates your services, clients and devices trust.

EZGH Private CA runs your own certificate authorities: root CAs, subordinate CAs signed by a CA in your project or by a root you already have, and the certificates they issue for your servers, mTLS clients and workloads. Certificates from a private CA are trusted only where you install its root certificate; none of them is publicly trusted.

Concepts

Hierarchies, name constraints, profiles, states and trust.

Create a CA

A root and its issuing CA, or a subordinate signed by your own root.

Issue certificates

From a CSR, or from a key EZGH generates and you export.

Managed certificates

Private certificates EZGH renews and deploys to EZGH services.

ACME

Issue with cert-manager, certbot or any ACME client, through External Account Binding.

Revocation

CRLs and OCSP, and revoking certificates and CAs.

Limits

Validity bounds, quotas, rate limits and retention.

API

The Private CA operations of the Certificates API.

CLI

The ezgh private-ca commands.

Hosts

Host	What it serves
`https://certificates.ezghcloud.com`	The Certificates API (Private CA shares it with Web Certificates). Called with an API key or your console session
`http://pki.ezghcloud.com`	CA certificates, CRLs and OCSP, over plain HTTP (and HTTPS), for relying parties. No credential
`https://pki.ezghcloud.com/acme/<ca>/directory`	Each subordinate CA’s ACME directory. Called with an ACME binding

The console’s Private CA pages (in Security) and the ezgh private-ca commands use the API.

Permissions

Action	Allows	Checked against
`certificates.certificateAuthorities.list`	List CAs	Project
`certificates.certificateAuthorities.get`	View a CA, its certificate, chain and CSR	CA
`certificates.certificateAuthorities.create`	Create CAs	Project
`certificates.certificateAuthorities.update`	Rename a CA, change its description and tags, shorten its longest certificate	CA
`certificates.certificateAuthorities.disable`	Disable a CA	CA
`certificates.certificateAuthorities.enable`	Enable a disabled CA	CA
`certificates.certificateAuthorities.delete`	Schedule a CA’s deletion	CA
`certificates.certificateAuthorities.restore`	Cancel a scheduled deletion	CA
`certificates.certificateAuthorities.renew`	Reissue a CA’s certificate for the same key	CA
`certificates.certificateAuthorities.revoke`	Revoke a subordinate CA this one signed	The parent CA
`certificates.certificateAuthorities.importCertificate`	Import an external subordinate’s certificate	CA
`certificates.certificateAuthorities.issue`	Issue from a CA by any path: CSR, generated key, managed certificate, ACME. Also needed on a parent to create a subordinate under it, and on a CA to create an ACME binding for it	CA
`certificates.privateCertificates.list`	List a CA’s issued certificates	CA
`certificates.privateCertificates.listAll`	List the project’s issued certificates across its CAs, with filters	Project
`certificates.privateCertificates.get`	View an issued certificate	Certificate
`certificates.privateCertificates.revoke`	Revoke a certificate	Certificate
`certificates.privateCertificates.exportKey`	Export a key EZGH generated, encrypted with your passphrase	Certificate
`certificates.privateCertificates.forgetKey`	Destroy the key EZGH holds for a certificate	Certificate
`certificates.privateCertificates.delete`	Delete a certificate’s record	Certificate
`certificates.acmeBindings.list`	List a CA’s ACME bindings	CA
`certificates.acmeBindings.get`	View an ACME binding (never its HMAC key)	ACME binding
`certificates.acmeBindings.create`	Create ACME bindings	CA
`certificates.acmeBindings.delete`	Delete an ACME binding	ACME binding

Managed policy	What it allows
`CertificatesFullAccess`	Every action above except `certificates.privateCertificates.exportKey`.
`CertificatesReadOnlyAccess`	Every list and view action.

ReadOnlyAccess allows what CertificatesReadOnlyAccess does. Exporting a key is in no managed policy: grant certificates.privateCertificates.exportKey in a policy of your own, to the people and bots that need it. AdministratorAccess and the root user can do everything.

Resources

Resource	Resource name
Certificate authority	`ezgh:us-west-1:<org>:<project>:pca_<slug>`
Issued certificate	`ezgh:us-west-1:<org>:<project>:pct_<slug>`
ACME binding	`ezgh:us-west-1:<org>:<project>:eab_<slug>`

Trails

Private CA’s events have the event source certificates.ezghcloud.com.

Recorded: every API call, as the rules for reads say, with event names such as CreateCertificateAuthority, IssueCertificate, RevokePrivateCertificate, ExportCertificatePrivateKey and CreateAcmeBinding. ACME orders, and revocations signed with an account’s key, are recorded as the binding’s owner, with the binding (eab_…) as the access key.
Never recorded: CSRs, certificates, keys, passphrases or HMAC keys; responses record IDs, serial numbers, fingerprints and validity only. Reads of CA certificates, CRLs and OCSP on pki.ezghcloud.com.