Docs
Smarter by Design.Simpler for Business

English

Türkçe

English

Türkçe

Appearance

Certificates & PKI ​

Certificates & PKI is the section where the certificates, the trust chains and the connection security policies used in the TLS connections TR7 offers and establishes are managed. In the Certificates & PKI tab in the Configuration Menu there are seven screens; the left menu lists these screens in the order they are in the interface.

The screens in the section complement one another: the certificates to be offered in the vServices are kept on the SSL/TLS Certificates screen; the version, cipher and validation rules of the connection established with these certificates are determined with TLS Security Profiles; the intermediate and root certificates in the chains and the internal certificate authorities are defined on the Certificate Authorities (CA) screen; the template of the certificates the internal CA produces is on Certificate Profiles, the identities TR7 offers as a client are on Client Certificates, the reusable keys are on Private Key Library and the provider credentials for the ACME DNS-01 validation are on the ACME DNS Providers screen.

7
Screens
In the card order in the Certificates & PKI tab in the interface
ACME
Automatic certificate
Obtaining and automatic renewal from Let's Encrypt and the other ACME authorities; a wildcard certificate with DNS-01
Internal PKI
Root and issuing CA
A two-level CA hierarchy on TR7; producing server and client certificates
mTLS
Two-way validation
Client certificate validation in the vService, offering a client certificate to the Backend Service

How do the screens work together?

  1. In order for a vService to be able to offer HTTPS, a certificate (ACME.SH, Manual, PFX or produced with the internal CA) is selected from the SSL/TLS Certificates screen and, optionally, a security profile from the TLS Security Profiles screen.
  2. The chain of the certificate can be offered with a reference to the records on the Certificate Authorities (CA) screen; the internal CAs on the same screen produce server and client certificates with the Certificate Profiles templates.
  3. In the connections in which TR7 introduces itself to the Backend Service the identities on the Client Certificates screen are used, and in the validation of the Backend Service certificate the CA records are.
  4. The certificates whose public key must not change when they are renewed are managed with the Private Key Library keys, and the ACME certificates with a wildcard domain name with the ACME DNS Providers profiles.

Screens ​

SSL/TLS Certificates
The certificates offered in the vServices: automatic obtaining and renewal with ACME.SH, Manual/PFX importing, production with the internal CA; the CSR (External CA) and Issued Certificates (Internal PKI) tabs, chain validation and PFX exporting.
→
TLS Security Profiles
The TLS version range, the cipher sets, the curves, the post-quantum key exchange, the SNI/Host validation, OCSP Stapling, HSTS and client certificate validation (mTLS); being applied in the vService and in the Backend Service.
→
Certificate Authorities (CA)
The trusted CA certificates and the internal PKI: producing a root and an issuing CA, enrolling under an external CA, importing an existing CA; the source of trust in the chain, in mTLS and in the Backend Service validation.
→
Certificate Profiles
The template of the certificates produced with the internal CA: the area of use, the validity period, the automatic renewal threshold, the key algorithm, the EKU and the SAN template.
→
Client Certificates
The client identities TR7 offers in the Backend Service connections and in the health checks: production with the internal CA (the e-mail address, the Windows logon name, the personnel number) or importing.
→
Private Key Library
Reusable private keys: producing, importing and taking from a certificate; having it signed again with the same key in the CSR requests (key pinning).
→
ACME DNS Providers
The provider credential profiles for the ACME DNS-01 validation: Cloudflare, Amazon Route 53, Azure DNS and Generic (acme.sh dnsapi) with a catalog of 171 plugins; wildcard certificates.
→

Usage Locations ​

ScreenWhere it is used
SSL/TLS CertificatesThe vService Certificate field, the Management Access HTTPS Certificate, the Backend Service and health check client certificate selectors
TLS Security ProfilesThe vService SSL Security module, the Backend Service Backend SSL Security Profile
Certificate Authorities (CA)The certificate chain (Use Profiles), the TLS profile CA Certificate Files, Verification CA Profile while certificate validation is on in the Backend Service and in the health check, the internal PKI production (Issuing CA)
Certificate ProfilesThe SSL/TLS Certificates (Internal CA type) and Client Certificates production forms
Client CertificatesThe Backend Service Client Certificate presented to backend (mTLS), the health check Client Certificate to present (mTLS)
Private Key LibraryThe SSL/TLS Certificates CSR (External CA) tab (Use a key from the library); the keys taken into the library with the Take the key into the library operation in the certificate list
ACME DNS ProvidersThe DNS Provider field in the SSL/TLS Certificates ACME.SH form (while Challenge Type: DNS-01 is selected)