---
title: "Private CA"
description: "Run private certificate authorities and issue the certificates your services, clients and devices trust."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private CA

EZGH Private CA runs your own certificate authorities: root CAs, subordinate CAs
signed by a CA in your project or by a root you already have, and the certificates they issue for
your servers, mTLS clients and workloads. Certificates from a private CA are trusted only where you
install its root certificate; none of them is publicly trusted.

- [Concepts](/private-ca/concepts) — Hierarchies, name constraints, profiles, states and trust.
- [Create a CA](/private-ca/create-a-ca) — A root and its issuing CA, or a subordinate signed by your own root.
- [Issue certificates](/private-ca/issue-certificates) — From a CSR, or from a key EZGH generates and you export.
- [Managed certificates](/private-ca/managed-certificates) — Private certificates EZGH renews and deploys to EZGH services.
- [ACME](/private-ca/acme) — Issue with cert-manager, certbot or any ACME client, through External Account Binding.
- [Revocation](/private-ca/revocation) — CRLs and OCSP, and revoking certificates and CAs.
- [Limits](/private-ca/limits) — Validity bounds, quotas, rate limits and retention.
- [API](/private-ca/api) — The Private CA operations of the Certificates API.
- [CLI](/private-ca/cli) — The ezgh private-ca commands.

## Hosts

| Host | What it serves |
| --- | --- |
| `https://certificates.ezghcloud.com` | The [Certificates API](/private-ca/api) (Private CA shares it with Web Certificates). Called with an API key or your console session |
| `http://pki.ezghcloud.com` | CA certificates, CRLs and OCSP, over plain HTTP (and HTTPS), for relying parties. No credential |
| `https://pki.ezghcloud.com/acme/<ca>/directory` | Each subordinate CA's [ACME directory](/private-ca/acme). Called with an ACME binding |

The console's **Private CA** pages (in Security) and the `ezgh private-ca` commands use the API.

## Permissions

| Action | Allows | Checked against |
| --- | --- | --- |
| `certificates.certificateAuthorities.list` | List CAs | Project |
| `certificates.certificateAuthorities.get` | View a CA, its certificate, chain and CSR | CA |
| `certificates.certificateAuthorities.create` | Create CAs | Project |
| `certificates.certificateAuthorities.update` | Rename a CA, change its description and tags, shorten its longest certificate | CA |
| `certificates.certificateAuthorities.disable` | Disable a CA | CA |
| `certificates.certificateAuthorities.enable` | Enable a disabled CA | CA |
| `certificates.certificateAuthorities.delete` | Schedule a CA's deletion | CA |
| `certificates.certificateAuthorities.restore` | Cancel a scheduled deletion | CA |
| `certificates.certificateAuthorities.renew` | Reissue a CA's certificate for the same key | CA |
| `certificates.certificateAuthorities.revoke` | Revoke a subordinate CA this one signed | The parent CA |
| `certificates.certificateAuthorities.importCertificate` | Import an external subordinate's certificate | CA |
| `certificates.certificateAuthorities.issue` | Issue from a CA by any path: CSR, generated key, managed certificate, ACME. Also needed on a parent to create a subordinate under it, and on a CA to create an ACME binding for it | CA |
| `certificates.privateCertificates.list` | List a CA's issued certificates | CA |
| `certificates.privateCertificates.listAll` | List the project's issued certificates across its CAs, with filters | Project |
| `certificates.privateCertificates.get` | View an issued certificate | Certificate |
| `certificates.privateCertificates.revoke` | Revoke a certificate | Certificate |
| `certificates.privateCertificates.exportKey` | Export a key EZGH generated, encrypted with your passphrase | Certificate |
| `certificates.privateCertificates.forgetKey` | Destroy the key EZGH holds for a certificate | Certificate |
| `certificates.privateCertificates.delete` | Delete a certificate's record | Certificate |
| `certificates.acmeBindings.list` | List a CA's ACME bindings | CA |
| `certificates.acmeBindings.get` | View an ACME binding (never its HMAC key) | ACME binding |
| `certificates.acmeBindings.create` | Create ACME bindings | CA |
| `certificates.acmeBindings.delete` | Delete an ACME binding | ACME binding |

| Managed policy | What it allows |
| --- | --- |
| `CertificatesFullAccess` | Every action above except `certificates.privateCertificates.exportKey`. |
| `CertificatesReadOnlyAccess` | Every list and view action. |

`ReadOnlyAccess` allows what `CertificatesReadOnlyAccess` does. Exporting a key is in no managed
policy: grant `certificates.privateCertificates.exportKey` in a policy of your own, to the people
and bots that need it. `AdministratorAccess` and the root user can do everything.

## Resources

| Resource | Resource name |
| --- | --- |
| Certificate authority | `ezgh:us-west-1:<org>:<project>:pca_<slug>` |
| Issued certificate | `ezgh:us-west-1:<org>:<project>:pct_<slug>` |
| ACME binding | `ezgh:us-west-1:<org>:<project>:eab_<slug>` |

## Trails

Private CA's events have the event source `certificates.ezghcloud.com`.

- **Recorded:** every API call, as the [rules for reads](/trails#what-trails-records) say, with
  event names such as `CreateCertificateAuthority`, `IssueCertificate`, `RevokePrivateCertificate`,
  `ExportCertificatePrivateKey` and `CreateAcmeBinding`. ACME orders, and revocations signed with an account's key, are recorded
  as the binding's owner, with the binding (`eab_…`) as the access key.
- **Never recorded:** CSRs, certificates, keys, passphrases or HMAC keys; responses record IDs,
  serial numbers, fingerprints and validity only. Reads of CA certificates, CRLs and OCSP on
  `pki.ezghcloud.com`.

Source: https://docs.ezghcloud.com/private-ca/index.mdx