feature: the package installs the Router Manager, which is no longer a package of its own.

docs/certificates.md

@@ -0,0 +1,30 @@
+# Certificates
+
+The router's two-level CA: a root CA and issuing CAs that sign the certificates.
+
+## Above the tabs
+
+- **Issue:** a certificate from a CSR, saved with its chain, or with a key the router makes, saved
+  as a PFX file protected by a password; the router keeps no copy of the key.
+- **Settings:** the names, lifetimes, key type, CRL validity and publishing endpoints.
+- **Warnings:** what needs attention, such as a CRL about to expire.
+
+## Tabs
+
+- **Root:** the root CA's subject and expiry, whether its key is on the router (marked with a
+  warning sign) or offline, and its CRL. **Download root CA** gives its certificate; **Upload CRL**
+  takes a root CRL signed offline. Below, the certificates of the issuing CAs.
+- **Templates:** key, lifetime, subject, usages, alternative names, certificate policies and the
+  CAs that issue each template. **Add template**, **Edit**, **Remove** for the router's own and
+  **Reset** for a changed built-in one.
+- **Extended key usages:** the usages templates may give, with their OIDs; custom ones are added
+  with a name and an OID.
+- **P2S Issuing CA** and **S2S Issuing CA:** the CAs of the VPN users and of site-to-site
+  connections. An active CA gives its CA bundle; a pending CA, waiting for the offline root, gives
+  its CSR and takes the certificate the root signed.
+- **Issuing CAs:** general-purpose CAs, each with its templates and an optional ACME server.
+  **Add issuing CA**, **Edit** and **Remove**; a removed CA is retired and its certificate revoked.
+- **Certificates:** each with its kind, template, names, expiry and state; one of another system
+  or of the router is revoked after a confirmation with a reason.
+
+The root key is exported, removed and imported on the router with `vpn-router-ca`, never here.