Certificates

The router's two-level CA: a root CA and issuing CAs that sign the certificates.

Above the tabs

Issue: a certificate from a CSR, saved with its chain, or with a key the router makes, saved as a PFX file protected by a password; the router keeps no copy of the key.
Settings: the names, lifetimes, key type, CRL validity and publishing endpoints.
Warnings: what needs attention, such as a CRL about to expire.

Root: the root CA's subject and expiry, whether its key is on the router (marked with a warning sign) or offline, and its CRL. Download root CA gives its certificate; Upload CRL takes a root CRL signed offline. Below, the certificates of the issuing CAs.
Templates: key, lifetime, subject, usages, alternative names, certificate policies and the CAs that issue each template. Add template, Edit, Remove for the router's own and Reset for a changed built-in one.
Extended key usages: the usages templates may give, with their OIDs; custom ones are added with a name and an OID.
P2S Issuing CA and S2S Issuing CA: the CAs of the VPN users and of site-to-site connections. An active CA gives its CA bundle; a pending CA, waiting for the offline root, gives its CSR and takes the certificate the root signed.
Issuing CAs: general-purpose CAs, each with its templates and an optional ACME server. Add issuing CA, Edit and Remove; a removed CA is retired and its certificate revoked.
Certificates: each with its kind, template, names, expiry and state; one of another system or of the router is revoked after a confirmation with a reason.

The root key is exported, removed and imported on the router with vpn-router-ca, never here.