---
title: "Managed certificates"
description: "Private certificates that EZGH issues, renews and deploys to the EZGH services you attach them to."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed certificates

A **managed certificate** from a private CA is a Web Certificates certificate like a public one:
EZGH generates its key, renews it, and delivers each new version to the EZGH services it's attached
to. Its key is never exported. Use one where an EZGH service terminates TLS for names your clients
reach privately.

It differs from a public managed certificate in a few ways:

- **DNS names only**, each within the CA's name constraints. No domain authorization, DNS record,
  CAA record or Certificate Transparency log is involved.
- **Each version is valid for the CA's longest certificate** (`maxLeafValidityDays`), never past
  the CA's own expiry, and is **renewed at two thirds of its lifetime**, by its CA. If the CA can't
  sign (it's disabled or deleted, say), renewal is blocked and the certificate says why; the
  current version keeps working until it expires.
- **Key algorithms** are ECDSA P-256 and RSA 2048.

## Request one

You need `certificates.certificates.create` in the project and
`certificates.certificateAuthorities.issue` on the CA.

- **Console:** **Web Certificates** › **Certificates** › **Request certificate**, then choose the
  CA under **Issuer** (it's offered when the project has an active issuing CA). The certificate's
  **Overview** names its issuer.
- **API:** [request a certificate](/certificates-api/RequestCertificate/) with
  `"issuer": {"type": "privateCa", "certificateAuthorityId": "<CA ID>"}`, and
  `domainAuthorizationIds` left out or `[]`. Every certificate's view has its `issuer`:
  `{"type": "publicAcme"}` or the private CA's.

A request is refused with `403` without `certificates.certificateAuthorities.issue` on the CA,
`404` for a CA that isn't in the project, `409` (`root_cannot_issue_leaves` or
`certificate_authority_inactive`) for a root or a CA that isn't active, and `400` naming a name
outside the CA's name constraints or an unsupported key algorithm.

Attach, detach, revoke and delete it as you would a public certificate. Revoking a version lists it
on its CA's CRL and OCSP. Each version also appears on the CA's **Issued certificates** tab.

Source: https://docs.ezghcloud.com/private-ca/managed-certificates/index.mdx