Nexus Certificate Manager
Nexus Certificate Manager
Breadcrumbs

Create Hybrid CA in Certificate Manager

This article is new for CM 8.15.

This article describes how to create a new self-signed or subordinate Hybrid Certificate Authority (CA) with multiple cryptographic algorithms in Smart ID Certificate Manager (CM). This task is performed in Administrator's workbench (AWB) in Certificate Manager (AWB).

The resulting Hybrid CA will have two key pairs: a primary key pair and an alternative key pair along with an alternative signature. They are carried in the following extensions:

  • id-ce-subjectAltPublicKeyInfo 2.5.29.72

  • id-ce-altSignatureAlgorithm 2.5.29.73

  • id-ce-altSignatureValue 2.5.29.74

Any key algorithm combinations are supported, but to provide both legacy compatibility and quantum resistance a combination of classical public-key algorithm (like RSA) with a Post-Quantum Cryptography algorithm (like ML-DSA) is recommended.

This follows section 7.2.2 Multiple cryptographic algorithms for public-key certificates in Recommendation ITU-T X.509 (10/19) | ISO/IEC 9594-8. This is also known as Chimera or Catalyst.

Prerequisites

  • Two administration officers must sign the request.

  • Both officers must have the following roles:

    • Use AWB

    • CA and Key tasks

  • A connection to the CM host must have been established. See Connect to a Certificate Manager host.

The following information is required by the officer during the task:

  • The CA name that will appear in the Authority Hierarchy in the explorer bar.

  • The name of the issuing CA when creating a subordinate hybrid CA.

  • The primary CA key to be used, created as described in Create CA key in Certificate Manager.

  • The alternative CA key to be used, created as described in Create CA key in Certificate Manager. The alternative key must reside in the same CIS instance as the primary key.

  • The primary and alternative signature algorithms.

  • The distribution rules applicable.

  • The required certificate format (rfc5280caaltkey) exists.

Step-by-step instruction

Request Hybrid CA

Clicking Save at any time during the creation of the Authority, before clicking OK, will save the data and place the incomplete Authority request in the Authority Hierarchy.

To complete the creation of the Authority at a later stage:

  • Highlight the unsigned Authority in the explorer bar.

  • Select Modify from the Edit menu, the toolbar, or the right-click shortcut menu.

The certificate attributes displayed in the Create Authority Request dialog can be customized. This is detailed in Set certificate attributes.

If the CA shall not be immediately published, steps 15 and 16 in the following procedure can be bypassed.

To create a Hybrid CA request:

  1. In AWB, select New > Authority.

  2. In the Create Authority Request dialog, enter the Authority name that should appear in the Authority Hierarchy in the explorer bar. This field is mandatory.

  3. Set the CA State to Active or Closed as required.

  4. Select Domain and check Visible in subdomain if applicable.

  5. Select the Authority type CA.

  6. In Format, click the browse button, select the rfc5280caaltkey format and click OK. This format is required for CAs with an alternative key and must be selected before choosing the alternative key so that the Alternative Key field is shown.

  7. Modify Valid from and Expiration date by selecting the days, hours, and minutes, and adjust the values with the up and down arrows. The date and time units may also be entered manually.

    If the CA is to be a subordinate CA, issued with a standard format definition, the expiration date will be truncated to the expiration date of the issuing CA if necessary.

  8. If the CA is to be a self-signed (root) CA, keep Issuing CA - Self signed checked (default) and go to step 10.

  9. If the CA is to be a subordinate hybrid CA, do the following:

    1. Uncheck Issuing CA - Self signed. Issuing CA is enabled. This field is now mandatory.

    2. Click the browse button, select the required CA and click OK.

    The selected CA appears in Issuing CA.

  10. Select the CA Usage by checking Certificate signing and/or CRL signing. Selection of at least one option is mandatory.

  11. In Key, click the browse button, select the primary CA key and click OK. The selected key appears in the Key field. This field is mandatory.

  12. Select the primary Signature algorithm from the drop-down list. The drop-down list contains only those algorithms that match the key algorithm for the selected primary key.

  13. In Alternative Key, click the browse button, select the alternative CA key and click OK. The selected key appears in the Alternative Key field.

  14. Select the Alt signature algorithm from the drop-down list. The drop-down list contains only those algorithms that match the key algorithm for the selected alternative key.

The primary and alternative signing keys must reside in the same CIS instance.

It is possible to disable the Alternative signature of the CA by checking the box Disable next to the Alt sign algorithm drop down list.

  1. For immediate publishing (skip steps 15 and 16 if publication will be done later), do the following steps in Distribution rules, for each relevant distribution rule:

    1. Click on + to open the Select Distribution Rules window.

    2. Select the required distribution rule for the CA certificate from the list in the window and click OK.

  2. When all the relevant distribution rules have been entered, edit the processing order of distribution rules if needed. To change the order, select a procedure and use the arrow buttons to move it up or down. The distribution rules will be processed in the order selected and then stored in CMDB.

  3. Continue to set the certificate attributes.

Additional information

Useful links


Last updated: