Certificate Authority¶

Use Certificate Authority to manage appliance CA desired state, Certificate Requests to review enrollment work, and the public certificate portal to provide approved unauthenticated CA and request workflows.

Interface overview¶

This verified appliance view provides visual orientation before you begin.

Atlaso Certificate Authority page in the clean-appliance desktop viewport.

Figure: Certificate Authority in the verified clean-appliance desktop state.

Manage the authority¶

Confirm the appliance FQDN and management HTTPS settings are correct.
Review root and leaf validity, subject, and key settings.
Leave Listen interfaces empty when the CA is needed only for appliance trust and managed service certificates. Select one or more interfaces only when the public CA portal should be published on those networks.
Resolve validation errors and inspect the rendered certificate preview.
Submit the Certificate Authority unit through Appliance Apply.

Atlaso encrypts CA root and leaf private keys with the appliance secrets key. Preserve that key with recovery material, and never expose private keys in documentation, screenshots, tasks, or logs.

An enabled CA with no listen interface still writes its root bundle and managed service certificates through global appliance apply. It does not add the CA portal to access-interface DNS, firewall, or public-service configuration.

Review requests¶

Use Certificate Requests to identify the requester, requested names, intended use, and current status before approving or rejecting enrollment. Confirm that every requested name belongs to the intended lab boundary. The management and public request lists use the same read-only collection pattern. Sort or inspect the rows normally; when an issued certificate can be revoked, open its row menu and select Revoke certificate. The shared confirmation states that revocation changes desired state and reaches appliance files only through the next global CA apply. The server-rendered list and revoke forms remain available when browser scripting is unavailable. The request wizard presents the common name, profile, multiline description, DNS SANs, and IP SANs on separate rows so long names, operator notes, and multi-value SAN lists remain readable before review. Descriptions stay with request identity, while enablement has a dedicated step for both certificate profiles and requests. CSR Intake uses the same guided pattern to separate metadata, SANs, PEM content, and final review.

The public portal exposes only the approved public certificate surface. It must not disclose operator-only state or offer administrative actions.

The management authority is canonical at /ui/management/certificate-authority, with its authenticated request list at /ui/management/ca/requests. The public trust and enrollment pages are /ui/public/ca and /ui/public/ca/requests. Root CA, bundle, leaf certificate, chain, and private-key download contracts retain their existing non-/ui paths. Eligible legacy GET/HEAD bookmarks redirect temporarily; public mutations are bridged internally and retain their CSRF, role, request validation, and listener checks.

Verify and recover¶

After apply, verify the presented management certificate and download the expected public root certificate. Keep a VM snapshot or equivalent rollback point before replacing active trust. Use VCF Certificate Trust for the separate task that installs the active Atlaso root into a supported VCF appliance.

Additional verified states¶

These captures show responsive layouts and useful operational states referenced by this page.

Certificate Authority¶

Atlaso Certificate Authority page in the clean-appliance responsive viewport.

Figure: Certificate Authority in the verified clean-appliance responsive state.

Certificate requests¶

Atlaso public Certificate Request Portal showing issued certificates in a read-only grid.

Figure: Public certificate requests rendered through the shared read-only grid in the desktop viewport.

Atlaso public Certificate Request Portal showing its read-only grid in the narrow viewport.

Figure: Public certificate requests remain contained in the narrow viewport.

Certificate requests (management)¶

Atlaso management Certificate Requests page showing issued certificates in a read-only grid.

Figure: Management certificate requests rendered through the shared read-only grid in the desktop viewport.

Atlaso management Certificate Requests page showing its read-only grid in the narrow viewport.

Figure: Management certificate requests remain contained in the narrow viewport.

Public certificate portal¶

Atlaso Public certificate portal page in the clean-appliance desktop viewport.

Figure: Public certificate portal in the verified clean-appliance desktop state.

Atlaso Public certificate portal page in the clean-appliance responsive viewport.

Figure: Public certificate portal in the verified clean-appliance responsive state.