A managed certificate from a private CA is a Web Certificates certificate like a public one: EZGH generates its key, renews it, and delivers each new version to the EZGH services it’s attached to. Its key is never exported. Use one where an EZGH service terminates TLS for names your clients reach privately.
It differs from a public managed certificate in a few ways:
- DNS names only, each within the CA’s name constraints. No domain authorization, DNS record, CAA record or Certificate Transparency log is involved.
- Each version is valid for the CA’s longest certificate (
maxLeafValidityDays), never past the CA’s own expiry, and is renewed at two thirds of its lifetime, by its CA. If the CA can’t sign (it’s disabled or deleted, say), renewal is blocked and the certificate says why; the current version keeps working until it expires. - Key algorithms are ECDSA P-256 and RSA 2048.
Request one
You need certificates.certificates.create in the project and
certificates.certificateAuthorities.issue on the CA.
- Console: Web Certificates › Certificates › Request certificate, then choose the CA under Issuer (it’s offered when the project has an active issuing CA). The certificate’s Overview names its issuer.
- API: request a certificate with
"issuer": {"type": "privateCa", "certificateAuthorityId": "<CA ID>"}, anddomainAuthorizationIdsleft out or[]. Every certificate’s view has itsissuer:{"type": "publicAcme"}or the private CA’s.
A request is refused with 403 without certificates.certificateAuthorities.issue on the CA,
404 for a CA that isn’t in the project, 409 (root_cannot_issue_leaves or
certificate_authority_inactive) for a root or a CA that isn’t active, and 400 naming a name
outside the CA’s name constraints or an unsupported key algorithm.
Attach, detach, revoke and delete it as you would a public certificate. Revoking a version lists it on its CA’s CRL and OCSP. Each version also appears on the CA’s Issued certificates tab.