# Certificates

The router's two-level CA: a root CA and issuing CAs that sign the certificates.

## Above the tabs

- **Issue:** a certificate from a CSR, saved with its chain, or with a key the router makes, saved
  as a PFX file protected by a password; the router keeps no copy of the key.
- **Settings:** the names, lifetimes, key type, CRL validity and publishing endpoints.
- **Warnings:** what needs attention, such as a CRL about to expire.

## Tabs

- **Root:** the root CA's subject and expiry, whether its key is on the router (marked with a
  warning sign) or offline, and its CRL. **Download root CA** gives its certificate; **Upload CRL**
  takes a root CRL signed offline. Below, the certificates of the issuing CAs.
- **Templates:** key, lifetime, subject, usages, alternative names, certificate policies and the
  CAs that issue each template. **Add template**, **Edit**, **Remove** for the router's own and
  **Reset** for a changed built-in one.
- **Extended key usages:** the usages templates may give, with their OIDs; custom ones are added
  with a name and an OID.
- **P2S Issuing CA** and **S2S Issuing CA:** the CAs of the VPN users and of site-to-site
  connections. An active CA gives its CA bundle; a pending CA, waiting for the offline root, gives
  its CSR and takes the certificate the root signed.
- **Issuing CAs:** general-purpose CAs, each with its templates and an optional ACME server.
  **Add issuing CA**, **Edit** and **Remove**; a removed CA is retired and its certificate revoked.
- **Certificates:** each with its kind, template, names, expiry and state; one of another system
  or of the router is revoked after a confirmation with a reason.

The root key is exported, removed and imported on the router with `vpn-router-ca`, never here.