Create your first CA

You will create a root authority with a new key kept by a Lamassu engine. The result is an active CA and its public certificate in ca.pem, ready to verify issuance in the next path.

Before you begin

Console access and permission to create keys and authorities.
An available cryptographic engine that supports the chosen algorithm.
OpenSSL 3.x to check the downloaded certificate.

Use an evaluation instance or an authority intended for these tests. The example creates a root that issues directly; to design an operational hierarchy, see Hierarchy and rotation.

Open the creation wizard

In Certification Authorities, select Create New CA and choose to create a CA with a new key pair.

The Create New CA (Existing Key) flow is explained in the authorities guide.

Select the key

Choose the engine that will keep the key and an algorithm its capabilities allow. For this example, you can use EC P-384 if available.

The CA private key is used through the engine. In this path, you will download only the authority's public certificate.

Define the authority

Select Root CA and complete:

CA Name: Acme Evaluation Root CA.
Subject: organization and country details for your evaluation.
CA Certificate Expiration: for example, one year from creation.
Default End-Entity Certificate Issuance Expiration: for example, 90 days, within the CA's lifetime.

The CA name becomes its Common Name. Keep the CA usages needed to sign certificates and CRLs.

Review and create the CA

Check the engine, algorithm, subject, root type and dates. Confirm creation and note the authority identifier so you can recognize it in the DMS or API.

Verify the result

Open the new CA. It should appear active, show its certificate and allow access to Issued Certificates.

Download or copy the authority's PEM certificate and save it as ca.pem. Check that the file contains the complete block, including BEGIN CERTIFICATE and END CERTIFICATE.

Check the CA certificate

Run from the directory where you saved ca.pem:

openssl x509 -in ca.pem -noout -subject -issuer -dates
openssl x509 -in ca.pem -noout -text
openssl verify -CAfile ca.pem -check_ss_sig ca.pem

Check that the subject and issuer match the root you created, the dates include the current time, Basic Constraints contains CA:TRUE and Key Usage allows certificate signing. The last command should return ca.pem: OK.

You explicitly selected ca.pem as the trust anchor for this test. A valid self-signature does not install that trust in other consumers. See the openssl-verify reference for verification options.

If the result fails

If creation fails, check permissions, engine availability and the selected algorithm.
If OpenSSL cannot read the file, copy the complete PEM block again.
If signature or date checks fail, check that you downloaded this CA's certificate and that your computer's clock is correct.

PKI diagnostics covers issuance checks and cryptographic dependencies.

Next step

Continue with Issue and verify a certificate, using this authority and ca.pem.

Create your first CA

On this page