Creating Certificate Authorities (CAs)

TrueNAS can act as a Certificate Authority (CA). When encrypting SSL or TLS connections to the TrueNAS system, you can import an existing CA or create a CA and certificate on the TrueNAS system. The certificate will appear in the drop-down menus for services that support SSL or TLS.

Go to System > CAs and click ADD. Name the CA, then choose the Type. The three type options are Internal CA, Intermediate CA, and Import CA. The process for each type is slightly different.

Set Internal CA as the Type.

You can select a profile for the CA to auto-fill options like Key Type, Key Length, Digest Algorithm. Otherwise, you must set options manually.

1. Select a Key Type from the drop-down. We recommend the RSA key type.
2. Select the Key Length. We recommend a minimum of 2048 for security reasons.
3. Select a Digest Algorithm. We recommend SHA256.
4. Enter the Lifetime of the CA in days to set how long the CA will remain valid.

1. Fill out the geographic information by entering the Country, Locality, Organizational Unit (optional), Common Name, State, Organization, Email, and Subject Alternate Names.
2. The Common Name is the fully-qualified hostname (FQDN) and must be unique within a certificate chain.

1. If you would like to have Basic Constraints, set Enabled to see more options.
2. Set a Path Length to determine how many non-self-issued intermediate certificates can follow the certificate in a valid certification path. Entering 0 allows a single additional certificate to follow in the certificate path.
3. Select one or more Basic Constraints Configs.

If you want an Authority Key Identifier, set it to Enabled, then select one or more Authority Key Configs.

TrueNAS uses Extended Key Usage for end-entity certificates.

1. If you want to utilize Extended Key Usage, set it to Enabled, then select one or more usages for the public key from the Usages drop-down.
2. Enable Critical Extension if you want to identify this extension as critical for the certificate. Do not enable Critical Extension if Usages contains ANY_EXTENDED_KEY_USAGE.

Using Extended Key Usage and Key Usage extensions requires that the certificate purpose is consistent with both extensions. See RFC 3280, section 4.2.1.13 for more details.

Select Intermediate CA as the Type.

You can select a profile for the CA to auto-fill options like Key Type, Key Length, Digest Algorithm. Otherwise, you must set options manually.

1. Select a Signing Certificate Authority from the drop-down.
2. Select a Key Type from the drop-down. We recommend the RSA key type.
3. Select the Key Length. We recommend a minimum of 2048 for security reasons.
4. Select a Digest Algorithm. We recommend SHA256.
5. Enter the Lifetime of the CA in days to set how long the CA will remain valid.

1. Fill out the geographic information by entering the Country, Locality, Organizational Unit (optional), Common Name, State, Organization, Email, and Subject Alternate Names.
2. The Common Name is the fully-qualified hostname (FQDN) and must be unique within a certificate chain.

1. If you would like to have Basic Constraints, set Enabled to see more options.
2. Set a Path Length to determine how many non-self-issued intermediate certificates can follow the certificate in a valid certification path. Entering 0 allows a single additional certificate to follow in the certificate path.
3. Select one or more Basic Constraints Configs.

If you want an Authority Key Identifier, set it to Enabled, then select one or more Authority Key Configs.

TrueNAS uses Extended Key Usage for end-entity certificates.

1. If you want to utilize Extended Key Usage, set it to Enabled, then select one or more usages for the public key from the Usages drop-down.
2. Enable Critical Extension if you want to identify this extension as critical for the certificate. Do not enable Critical Extension if Usages contains ANY_EXTENDED_KEY_USAGE.

Using Extended Key Usage and Key Usage extensions requires that the certificate purpose is consistent with both extensions. See RFC 3280, section 4.2.1.13 for more details.

Select Import a CA as the Type.

1. Copy the certificate for the CA you want to import and paste it into the Certificate field.
2. Paste the certificate Private Key when available. Provide a key at least 1024 bits long.
3. Enter and confirm the Private Key Passphrase.

Related Content

• Creating Certificates
• CAs
• Certificates
• Configuring ACME DNS
• ACME DNS