Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is PKI (Public Key Infrastructure)?
Short answer
PKI (Public Key Infrastructure) is the whole of the CAs, policies and processes used for generating, signing, distributing, renewing and revoking certificates; with their own PKI, organizations issue certificates for internal services, devices and users and bind them to their own root CAs. In TR7, in the Configuration Menu, these functions are gathered in the Certificates & PKI tab: the internal PKI issues server and client certificates with the two-tier CA hierarchy on the Certificate Authorities (CA) screen and with the Certificate Profiles templates; it automatically renews the server certificates it has issued before they expire.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Configuration Menu → Certificates & PKI | SSL/TLS Certificates, TLS Security Profiles, Certificate Authorities (CA), Certificate Profiles, Client Certificates, Private Key Library, ACME DNS Providers | Certificate and PKI management |
| Certificates & PKI → Certificate Authorities (CA) | Create Root CA, Create Issuing CA, Enroll under an external CA, Import Existing CA | Setting up the Internal CA hierarchy |
| Certificates & PKI → Certificate Profiles | Usage (TLS server, Client / mTLS), Lifetime (days) (365), Renew this many days before expiry (30), Extended Key Usage, SAN Template, Key Algorithm | The template of the certificates to be issued |
| Certificates & PKI → SSL/TLS Certificates → Add → Internal CA | Issuing CA, Certificate Profile, Common Name (CN) | Issuing a server certificate with Internal CA |
| Certificates & PKI → Client Certificates | Issue from an internal CA | Issuing a client certificate with Internal CA |
| SSL/TLS Certificates → Issued Certificates (Internal PKI) | Status: Active, Superseded | The record of the certificates issued by the Internal CA; the old record of a renewed certificate becomes Superseded |
Common Misconceptions
- "PKI is only for large organizations." For internal services, issuing and renewing certificates automatically reduces the maintenance load even in small environments.
- "Internal PKI certificates can be used on the internet." The Internal Root CA certificate is distributed only to the clients of the organization; for internet users, a public CA (e.g. Let's Encrypt with ACME) is required.
- "In the internal PKI, everything is renewed automatically." Server certificates bound to a profile are renewed automatically; CA certificates are renewed manually with Renew Certificate in the right-click menu (Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?).
How it is done in the documentation
