PKI getting started

This path is intended for those starting to administer PKI or needing a first X.509 client identity. It ends with three files: a root CA certificate, an end-entity certificate and the client's private key.

Before you begin

A Lamassu instance accessible from your browser. To prepare one, see Deployment.
Permission to manage keys, authorities and issuance. See Access control if an operation is blocked.
An available cryptographic engine for the CA key; check the keys and engines inventory.
OpenSSL 3.x on the computer where you will verify the files.
A working directory with restricted access for the downloaded key.

Recommended path

1. Create your first CA

Create an evaluation root and save its public certificate as ca.pem.

2. Issue and verify a certificate

Issue for device-001 and check content, chain and key correspondence.

We use Acme Evaluation Root CA and device-001 as example names. If you replace them, keep the same client identifier in the steps you want to connect.

The root in this path signs the end-entity certificate directly to simplify evaluation. Before designing an operational PKI, review the trust model and CA hierarchy.

Expected result

File or resource	Check
Active root CA and `ca.pem`	It is a CA certificate, is currently valid and its self-signature verifies.
End-entity certificate and `device.crt`	It identifies `device-001`, supports client authentication and verifies against `ca.pem`.
Private key `device.key`	Its public key matches the one included in `device.crt`.

These checks validate the issued material. Acceptance by a service also requires its trust, authorization and revocation configuration.

Continue according to your goal

To operate certificates, continue with Certificates and Validation.
To manage a device identity in Lamassu, follow Manual registration. That path includes DMS preparation.
For the device to request its certificate, prepare the DMS and EST client.