Appendix 1. Running a Certificate Authorityedit
A Certificate Authority (CA) can greatly simplify managing trust. Instead of trusting hundreds of certificates individually, a client only needs to trust the certificate from the CA. When the CA signs other node certificates, nodes that trust the CA also trust other nodes with certificates signed by the CA.
This procedure is an example of how to set up a CA and cannot universally address a wide array of security needs. To properly secure a production site, consult your organization’s security experts to discuss requirements.
To run a CA, generate a public and private key, and wrap the public key in a certificate that clients will trust.
Node certificates are sent in a Certificate Signing Request (CSR). Your CA signs the CSR, producing a newly signed certificate that you install on the node.
Because a Certificate Authority is a central point for trust, the private keys to the CA must be protected from compromise.