Certificate authority

Ironchip can act as a certificate authority (CA) to issue and manage server certificates (HTTPS and SSH) and client certificates (HTTPS, SSL, and IPsec VPN). This page shows administrators how to create or import the CA, issue certificates, and manage their lifecycle.

Requirements

• Access to the Ironchip admin console with an administrator role.
• The intended use of the certificates (HTTPS, SSH, SSL, or IPsec VPN).
• To act as an intermediate CA: the certificate and private key of the parent CA, or a CSR signed by it.

Create the certificate authority

The first step is to create the CA in the Ironchip admin console. Ironchip can work in two ways:

• Final (root) CA: Ironchip signs certificates directly. This is the simplest option for closed environments.
• Intermediate CA: Ironchip signs certificates with a subordinate CA whose own signature comes from the corporate CA. This is the recommended option when you already have a PKI.

1. Go to Certificates and click New CA.
2. Select the CA type (Root CA or Intermediate CA) and fill in these fields:
   • Name: a name that identifies the CA.
   • Common Name: the name that appears in the CN field of the CA certificate.
   • Key algorithm: RSA 4096 or ECDSA P-384. ECDSA P-384 is recommended for new deployments.
   • Validity: the validity period of the CA. For an intermediate CA, it can’t exceed that of the parent CA.
   • Path length: the maximum number of subordinate CAs that can depend on this CA. If the CA only issues end-entity certificates, enter 0.
3. If you selected Intermediate CA, click Generate CSR, download the file, and sign it with your parent CA. Then come back to this screen and click Upload signed certificate to upload the signed certificate along with the full chain.
4. Click Create CA.

The private key is generated and stored encrypted in Ironchip, and it can’t be exported.

Import an existing CA

If you already have a CA and want Ironchip to use it to issue certificates:

1. Go to Certificates and click Import CA.
2. Upload these files:
   • The CA certificate in PEM format.
   • The CA private key in PEM format, with or without a password.
   • The certificate chain up to the root, if there is one.

Before importing, check that the private key matches the certificate. Run these commands and verify that the two fingerprints match:

openssl x509 -in ca.crt -noout -pubkey | openssl sha256
openssl pkey -in ca.key -pubout | openssl sha256

Note

A CA imported with its private key becomes managed by Ironchip. If you don’t want the key to leave your infrastructure, use the intermediate CA mode with a CSR.

Issue server certificates (HTTPS and SSH)

To issue a server certificate, go to Certificates, select the CA, and click New certificate. Choose the profile you need.

HTTPS profile

This profile generates a certificate with the Server Authentication key usage. Enter the Common Name and the Subject Alternative Names (DNS or IP) of the service. You can paste your own CSR or let Ironchip generate the key pair.

If you prefer to generate the key on the server itself, create the CSR with this command and paste its contents in the console:

openssl req -new -newkey rsa:4096 -nodes -keyout servidor.key -out servidor.csr -subj "/CN=intranet.empresa.com" -addext "subjectAltName=DNS:intranet.empresa.com"

SSH profile

This profile generates an SSH host certificate signed by the CA, so clients trust the server without having to accept its fingerprint manually. Paste the server’s public key (for example, the contents of /etc/ssh/ssh_host_ed25519_key.pub) and enter the valid hostnames.

1. Download the issued certificate and copy it to the server.

2. Add this line to /etc/ssh/sshd_config:

   /etc/ssh/sshd_config

   HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub

3. On the clients, add the CA as a trusted authority in ~/.ssh/known_hosts:

   ~/.ssh/known_hosts

   @cert-authority *.empresa.com <SSH CA public key>

4. Restart the SSH service to apply the changes:

   sudo systemctl restart sshd

Issue client certificates (HTTPS, SSL, and IPsec VPN)

Client certificates let you authenticate a device or a user to a service. Go to Certificates, select the CA, and click New certificate with one of these profiles:

• Client HTTPS/SSL: a certificate with the Client Authentication key usage, for mTLS in web applications and SSL services.
• VPN IPsec: a certificate with the Client Authentication and IPsec end system key usages, for IKEv2 tunnels with certificates.

For each client certificate, enter:

• Subject: the user or device the certificate belongs to. If you select an Ironchip user, the certificate is linked to their identity.
• Validity: the validity period. A maximum of 12 months is recommended for device certificates.
• Export format: PEM or PKCS#12 (.p12). With PKCS#12, set an export password.

Download the certificate and install it on the device. This is an example configuration of an IKEv2 client with strongSwan:

ipsec.conf

conn ironchip-vpn
    keyexchange=ikev2
    left=%any
    leftcert=cliente.crt
    leftid=%fromcert
    right=vpn.empresa.com
    rightid=@vpn.empresa.com
    rightsubnet=0.0.0.0/0
    auto=start

The VPN server must have the Ironchip CA certificate installed as a trusted authority, to validate the client certificates.

Manage the certificate lifecycle

In Certificates you can review all issued certificates, filter them by CA, profile, user, or status, and run these actions:

• Renew: issues a new certificate with the same data and keeps the previous one until it expires.
• Revoke: revokes the certificate and records the reason. The revocation is published immediately in the CRL and the OCSP service.
• Download: downloads the certificate or the full chain.
• Export audit log: downloads the history of issuances, renewals, and revocations.

For services to check the revocation status, configure these URLs in them, replacing <id-ca> with the identifier of your CA:

CRL:  https://pki.ironchip.com/crl/<id-ca>.crl
OCSP: https://pki.ironchip.com/ocsp/<id-ca>

In Alerts, set how many days in advance you want to receive an email notice about certificates that are about to expire.