Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?

Short answer

Issuing and automatic renewal yes, revocation no. A root CA and an issuing CA are created in TR7; the lifetime and renewal period of the certificates are defined with Certificate Profiles. Type = Internal CA certificates are issued with this profile and are renewed automatically before they expire; the record and the vService assignments are preserved. The client certificates on the Client Certificates screen are not renewed automatically. There is no certificate revocation, CRL or OCSP responder.

Issuing

1

Adım 1 Open the root CA form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked (how to add).

2

Adım 2 Define the root CA

CA Name is entered; Operation = Create Root CA is selected and Common Name (CN) is entered (required). Key Algorithm (default RSA 4096) and Lifetime (days) (default 3650) are changed if necessary.

3

Adım 3 Save the root CA

Add is clicked.

4

Adım 4 Open the issuing CA form

Add is clicked again on the same screen.

5

Adım 5 Define the issuing CA

CA Name is entered; Operation = Create Issuing CA is selected. Usage = Server Certificates (Client Certificates for client certificates) and Parent CA = the root CA from step 3 are selected, and Common Name (CN) is entered. The certificates are issued with this CA, not with the root.

6

Adım 6 Save the issuing CA

Add is clicked.

7

Adım 7 Open the profile form

On the Certificates & PKI → Certificate Profiles screen, Add is clicked (how to add).

8

Adım 8 Define the profile

Profile Name is entered; Usage = TLS Server is selected. Lifetime (days) (default 365) and Renew this many days before expiry (default 30; 0 turns off automatic renewal) are set; Extended Key Usage, SAN Template and Key Algorithm are changed if necessary.

9

Adım 9 Save the profile

Add is clicked.

10

Adım 10 Open the certificate form

On the Certificates & PKI → SSL/TLS Certificates screen, Add is clicked (how to add).

11

Adım 11 Define the certificate

Certificate Name is entered; Type = Internal CA is selected. Issuing CA = the CA from step 6 and Certificate Profile = the profile from steps 8–9 are selected; Common Name (CN) and Alternative Names (SAN) are entered.

12

Adım 12 Save the certificate

Add is clicked; the key and the certificate are generated on the device. The certificate is used by selecting it in the Certificate field of the vService. Client certificates are issued on the Certificates & PKI → Client Certificates screen, with an issuing CA with Client Certificates usage and a profile with Client / mTLS usage (how to add).

In WEB-CLI, if the CA and the profile are ready, the certificate is issued with a single command; in place of <issuing-ca> and <profile>, the records are selected with Tab (issue-internal):

lb certificate issue-internal name portal-ic caId <issuing-ca> profileId <profile> cn portal.example.local --san "portal.example.local,api.example.local"

Renewal

	Behavior
Automatic	It is checked every day at 07:00 and 22:00 and a few minutes after the device starts; when the remaining time falls below the number of days in the profile, the certificate is reissued with a new key and serial number
Manual	Renew Now (internal CA) from the right-click menu in the certificate list; the command below in WEB-CLI
Scope	Internal CA certificates in the SSL/TLS Certificates list; the ones on the Client Certificates screen are not renewed automatically
vServices	Since the record stays the same, the new certificate is presented automatically
Result	Every renewal, successful or failed, is written to the Settings → System Logs → User Logs screen (e.g. Internal CA certificate could not be renewed)
Cluster	The renewal is performed on the device that issued the certificate; the result is sent to the peer device together with the configuration

The manual renewal command; the command asks for confirmation and the vService is reloaded with the new certificate (renew-internal):

lb certificate renew-internal certId portal-ic

Revocation

• There is no certificate revocation, CRL generation or OCSP responder; the issued certificates do not contain the address of the revocation information (CRL or OCSP).
• To end the use of a server certificate, the certificate is removed from the vService or deleted. In mTLS, to exclude clients collectively, the related CA is removed from the CA Certificate Files list in the TLS Security Profile.

Common Misconceptions

• "I issue a server certificate directly with the root CA." In the Issuing CA list of the certificate form, only issuing CAs with Server Certificates usage appear, and in the Certificate Profile list, only profiles with TLS Server usage; the certificates are issued with the issuing CA under the root.
• "Certificates whose profile is deleted continue to be renewed." If the profile is deleted, automatic renewal is not performed; a could-not-be-renewed record is written to User Logs.
• "OCSP stapling works on internal CA certificates." Since the certificates contain no OCSP address, a staple cannot be obtained (Is OCSP Stapling supported?).
• "Clients recognize the internal CA automatically." The root CA certificate is distributed separately to the trust store of the clients.

How it is done in the documentation

• Certificate Authorities · Create root CA
• Certificate Profiles · Renew this many days before expiry
• SSL/TLS Certificates · Internal CA
• WEB-CLI · lb certificate renew-internal

Related questions

• How do I add my own internal CA to TR7?
• Can I authenticate clients with client certificates (mTLS)?
• When I renew a certificate, do I need to replace it on each vService one by one?