Certificate Management with RSA, EC, ML-DSA & Terraform

CA hierarchy

SecuriTLS supports Root CAs, Intermediate CAs, and Leaf certificates. A common internal PKI pattern is to keep the Root more isolated and issue operational certificates from one or more Intermediate CAs.

Issuance

You can generate certificates directly within SecuriTLS for deployment workflows. Intermediate and Leaf certificates can include CRL Distribution Points and Authority Information Access metadata for revocation checking.

Issue a certificate with the API

$ curl -X POST https://www.securitls.com/api/certificates \
-H "Authorization: Bearer $SECURITLS_JWT" \
-H "Content-Type: application/json" \
-d '{
  "commonName": "api.internal.example",
  "type": "leaf",
  "signer": "6a39e9de9d46b16778b41ff0",
  "expireIntervalDays": 365
}'

✓ Leaf certificate issued and encrypted in storage

Manage certificate hierarchies with Terraform

Use the SecuriTLS Terraform provider to declare CA relationships directly in HCL. When a CA advances to a successor certificate, dependent certificate references can follow the updated certificate ID through Terraform.

resource "securitls_certificate" "root" {
  type                 = "root"
  common_name          = "Example Corp Root"
  expire_interval_days = 3650
}

resource "securitls_certificate" "intermediate" {
  type                 = "intermediate"
  common_name          = "Example Corp Intermediate"
  expire_interval_days = 1825
  signer               = securitls_certificate.root.id
}

resource "securitls_certificate" "leaf" {
  type                 = "leaf"
  common_name          = "Example Corp Leaf"
  expire_interval_days = 47
  signer               = securitls_certificate.intermediate.id
}

Explicit lifecycle operations can also be driven by changing renew_trigger, rekey_trigger, or reissue_trigger. The trigger value is opaque; changing it requests the operation without requiring a boolean reset cycle.

Terraform PKI guide Terraform Registry

Certificate key algorithms

SecuriTLS supports RSA, elliptic curve (EC), and ML-DSA key pairs for certificate authorities and leaf certificates.

Algorithm	Supported parameters	Signature options
RSA	2048, 3072, 4096 bits	SHA-256, SHA-384, SHA-512
Elliptic Curve	P-256 (prime256v1) P-384 (secp384r1) P-521 (secp521r1)	SHA-256, SHA-384, SHA-512
ML-DSA	ML-DSA-44 ML-DSA-65 ML-DSA-87	Defined by the selected ML-DSA parameter set. No separate SHA-2 signature hash is selected.

Post-quantum support: ML-DSA is standardized by NIST in FIPS 204 for post-quantum digital signatures. RSA and EC remain available for compatibility and migration planning.

Mixed-algorithm PKI hierarchies

The subject certificate public-key algorithm does not have to match the algorithm used by its issuing CA. SecuriTLS supports mixed-algorithm certificate hierarchies, allowing you to test and operate crypto-agile private PKI.

RSA CA → RSA, EC, or ML-DSA certificate
EC CA → RSA, EC, or ML-DSA certificate
ML-DSA CA → RSA, EC, or ML-DSA certificate

The certificate public-key algorithm describes the subject key. The certificate signature is produced by the issuing CA, so its signing algorithm follows the issuer key type.

Lifecycle operations

Renew
Rekey
Reissue
Revoke

SecuriTLS monitors certificates once every hour to detect and warn about upcoming expiration events.

Certificate extensions

Intermediate and Leaf certificates include revocation related metadata such as CRL Distribution Points and Authority Information Access. They also include Authority Key Identifier values that can be matched against the issuer Subject Key Identifier.

Authority Key Identifier and Subject Key Identifier

You can match the keyid from the Authority Key Identifier extension to the issuer certificate Subject Key Identifier value.

X509v3 Authority Key Identifier:
    keyid:<ISSUER SUBJECT KEY IDENTIFIER>
    DirName:<ISSUER DN>
    serial:<ISSUER X509 SERIAL NUMBER>

Certificates