SecuriTLS - Certificates

Certificates

Create and manage Root, Intermediate, and Leaf X.509 certificates, then rotate and revoke them safely.

CA hierarchy

SecuriTLS supports Root CAs, Intermediate CAs, and Leaf certificates. A common internal PKI pattern is to keep the Root more isolated and issue operational certificates from one or more Intermediate CAs.

Issuance

You can generate certificates directly within SecuriTLS for deployment workflows. Intermediate and Leaf certificates can include CRL Distribution Points and Authority Information Access metadata for revocation checking.

Issue a certificate with the API

$ curl -X POST https://www.securitls.com/api/certificates \
-H "Authorization: Bearer $SECURITLS_JWT" \
-H "Content-Type: application/json" \
-d '{
  "commonName": "api.internal.example",
  "type": "leaf",
  "signer": "6a39e9de9d46b16778b41ff0",
  "expireIntervalDays": 365
}'

✓ Leaf certificate issued and encrypted in storage

Lifecycle operations

Renew
Rekey
Reissue
Revoke

SecuriTLS monitors certificates once every hour to detect and warn about upcoming expiration events.

Certificate extensions

Intermediate and Leaf certificates include revocation related metadata such as CRL Distribution Points and Authority Information Access. They also include Authority Key Identifier values that can be matched against the issuer Subject Key Identifier.

Authority Key Identifier and Subject Key Identifier

You can match the keyid from the Authority Key Identifier extension to the issuer certificate Subject Key Identifier value.

X509v3 Authority Key Identifier:
    keyid:<ISSUER SUBJECT KEY IDENTIFIER>
    DirName:<ISSUER DN>
    serial:<ISSUER X509 SERIAL NUMBER>