FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

How do I add my own internal CA to TR7? ​

Short answer

The internal CA's certificate is added on the Certificates & PKI → Certificate Authorities (CA) screen with Add, by selecting Operation = Add a trusted CA certificate. This trust record is selected in the certificate chain (Use Profiles), in client certificate validation (CA Certificate Files in the mTLS profile), and in Backend Service certificate validation and the health check (Verification CA Profile) (usage locations). If TR7 is also to produce certificates on behalf of the internal CA, the CA is imported with its key (Import Existing CA), or a sub-CA produced on TR7 is signed by the organization's CA (Enroll under an external CA).

Problem: TR7 Does Not Recognize the Organization's Own CA ​

In corporate environments, the certificates of internal servers and users come from the organization's own CA. For TR7 to be able to trust these certificates (Backend Service validation, mTLS, presenting the chain) or to produce certificates on behalf of this CA, the internal CA must be introduced to TR7.

Solution: Four Methods ​

Methods 1 and 2 only add a trust record; Methods 3 and 4 give TR7 the authority to produce certificates in this CA hierarchy.

Your situationSuitable method
TR7 should only trust this CA (validation, mTLS, chain)Method 1: Add a trusted CA certificate
Adding the trust record from the command lineMethod 2: WEB-CLI
TR7 should produce certificates with this CA's keyMethod 3: Import Existing CA
The CA key cannot be given to TR7; TR7 should be a sub-CA under the organization's CAMethod 4: Enroll under an external CA
  • How it works The CA certificate is added as a trust record (trust anchor); TR7 trusts the certificates signed by this CA but cannot sign certificates.
  • Where it is openedCertificates & PKI → Certificate Authorities (CA) → Add → Operation = Add a trusted CA certificate
  • Requirement CA certificate (PEM, PKCS#7/P7B or DER)
  • Scope Certificate chain, mTLS, Backend Service validation, health check

Step-by-Step Configuration ​

1
Adım 1 Open the CA add form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked (how to add).

2
Adım 2 Enter the CA certificate

The CA Name is entered; in the Operation field, the default Add a trusted CA certificate is left as is. The certificate is pasted into the CA Certificate (PEM) field, or a file is dragged (at most 32 KB); P7B and DER content is converted to PEM during saving. If there are root and intermediate CAs, each can be added as a separate record.

3
Adım 3 Save

Add is clicked; the record is added to the list with the Trust Anchor kind. In a cluster setup, with the default auto-sync, the record is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

The record is selected in the following fields as needed:

PurposeField
Presenting it in the certificate's chainSSL/TLS Certificates → Intermediate Cert. Content / Root Cert. Content → Use Profiles (How do I add the intermediate certificate chain?)
Validating client certificates (mTLS)TLS Security Profile → CA Certificate Files (Can I authenticate clients with client certificates (mTLS)?)
Validating the Backend Service certificateBackend Service → Certificate Verification = Required → Verification CA Profile (Can I verify the backend certificate when connecting to the backend over HTTPS?)
Validating the server certificate in the health checkVerification CA Profile in the Health Check profile; if it is empty, the Backend Service's is used

Verification ​

1Record and chainTR7 side

In the preview of the CA record, the CN and the validity are read; the Chain tab of a certificate that was signed by the internal CA and whose chain is built with this record is checked.

ExpectedTrust chain is complete
The Chain tab searches the chain up to a self-signed root CA. If the added CA is an intermediate CA, the "Missing intermediate certificate — required issuer" message appears unless the root CA is also added and selected separately.

Method 2: WEB-CLI ​

  • How it works The trust record is added from the command line. Because WEB-CLI runs each line as a separate command, the CA certificate is given as single-line Base64 (DER) instead of multi-line PEM; TR7 converts it to PEM during saving.
  • Where it is opened TR7 WEB-CLI → lb ca add
  • Requirement WEB-CLI access; the single-line Base64 form of the CA certificate
  • Scope Same as Method 1

Step-by-Step Configuration ​

1
Adım 1 Convert the certificate to a single line

On the administrator's computer, the PEM file is converted to Base64 that contains no line breaks:

text
openssl x509 -in kurum-kok-ca.pem -outform DER | base64 -w0
2
Adım 2 Add the record

In place of <base64>, the output of step 1 is pasted (lb ca add):

text
lb ca add name kurum-kok-ca --content <base64>

Verification ​

1RecordTR7 side

Command: lb ca list

Expectedkurum-kok-ca in the list

Method 3: Import Existing CA ​

  • How it works The CA certificate is imported together with its private key and saved on TR7 as a root CA with a key; TR7 can create an issuing CA under this root and produce server and client certificates.
  • Where it is openedCertificates & PKI → Certificate Authorities (CA) → Add → Operation = Import Existing CA
  • Requirement CA certificate and its private key (PEM)
  • Scope Internal PKI (Internal CA certificates, Client Certificates)

Step-by-Step Configuration ​

1
Adım 1 Open the CA add form

On the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked.

2
Adım 2 Enter the CA and the key

The CA Name is entered; Operation = Import Existing CA is selected. The CA Certificate (PEM) and CA Private Key (PEM) fields are filled in; if the key has a passphrase, the Key Passphrase (if encrypted) is entered.

3
Adım 3 Save

Add is clicked; the record is listed as an Internal Root CA.

4
Adım 4 Create an issuing CA

To produce certificates, Operation = Create Issuing CA is selected with Add on the same screen, the imported root is selected in the Parent CA field, the Usage (Server Certificates or Client Certificates) and the Common Name (CN) are entered, and Add is clicked (Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?).

Verification ​

1CA listTR7 side

The kind of the record is read in the Certificate Authorities (CA) list.

ExpectedInternal Root CA

Method 4: Enroll Under an External CA ​

  • How it works TR7 produces a key and a request (CSR) for the sub-CA; the request is signed by the organization's CA, and when the signed sub-CA certificate is uploaded, TR7 becomes an issuing CA that can produce certificates under the organization's hierarchy. The key of the organization's CA is not given to TR7.
  • Where it is openedCertificates & PKI → Certificate Authorities (CA) → Add → Operation = Enroll under an external CA
  • Requirement The organization's CA being able to sign a sub-CA certificate
  • Scope Internal PKI (Internal CA certificates, Client Certificates)

Step-by-Step Configuration ​

1
Adım 1 Open the CA add form

On the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked.

2
Adım 2 Define the request

The CA Name is entered; Operation = Enroll under an external CA is selected. The Usage (Server Certificates or Client Certificates), the Common Name (CN) and, optionally, Organization (O), Organizational Unit (OU) and Country (C), together with Key Algorithm (default RSA 4096), are entered; the validity period is determined by the organization's CA.

3
Adım 3 Save the request

Add is clicked; the record is created in the Enrollment Pending status. The CSR content is not shown in the interface; it is taken from the /api/lb/pki/caCsrContent/<record identity> endpoint in the REST API of the device (Completing the Enrollment Under an External CA).

4
Adım 4 Open the signed certificate window

After the CSR is signed by the organization's CA, Upload the signed CA certificate is selected in the record's preview or right-click menu (completing the enrollment).

5
Adım 5 Paste the certificate

The signed sub-CA certificate (with its chain, if there is one) is pasted into the Signed Certificate (PEM) field.

6
Adım 6 Save

Accept is clicked; the certificate is validated with the key in the record, and the record becomes an Internal Issuing CA.

Verification ​

1CA listTR7 side

The kind of the record is read in the Certificate Authorities (CA) list.

ExpectedInternal Issuing CA

Common Mistakes ​

  • Expecting to produce certificates with a trust record. Add a trusted CA certificate provides only trust; to produce certificates, a CA with a key (Method 3 or 4) is required.
  • Looking only at the Used in tab before deleting. Used in shows the definitions that use this CA in their chain; the TLS profile, Backend Service and health check usages are checked separately.
  • Trying to produce a server certificate directly with the root CA. Certificates are produced with an issuing CA under the root; root CAs are not listed in the Internal CA and Client Certificates selectors.
  • Forgetting to distribute the root CA to the clients. For browsers and clients to trust certificates from the internal CA, the root certificate is distributed separately to the clients' trust store.

How it is done in the documentation

Related questions