Build OCI Certificates service CA configurations with subject details and CRL settings.
Last verified: May 2026
Build OCI Certificates service Certificate Authority configurations with subject details, signing algorithms, and CRL settings.
Required Fields
compartmentIddisplayNamecertificateAuthorityConfig.configTypecertificateAuthorityConfig.subject.commonNamekmsKeyIdOutput will appear here...Your team needs to issue thousands of internal-service-to-internal-service TLS certificates without using a commercial CA (cost) or Let's Encrypt (rate limits + public exposure). The builder generates: an OCI Private Root CA with 10-year validity, two subordinate CAs (one per environment) with 5-year validity, configured CRL distribution points reachable from internal services. Service-to-service certs issued via the subordinate CAs with 90-day validity. Total cost: ~$200/month for the root + 2 subordinates + cert issuance vs $5K+/month for equivalent commercial CA capacity.
Build OCI Certificates service CA configurations with subject details and CRL settings. This tool helps OCI engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.
The builder constructs OCI Certificates CA configurations: CA resource (compartment, kind: ROOT or SUBORDINATE, name, description, subject distinguished name with common name + organization + country, validity period, signing algorithm, key vault key reference for backing key material, CRL distribution point URLs, certificate revocation reasons supported). Output is generated as oci certs-mgmt certificate-authority commands and Terraform oci_certificates_management_certificate_authority resources.
Private CAs are the right answer for internal-only TLS (service-to-service, internal APIs). Use OCI Certificates' private CA hierarchy to issue certs for internal hostnames. For external-facing certs, stick with Let's Encrypt or commercial CAs — public trust is what matters there.
CRL (Certificate Revocation List) distribution requires reachable CRL endpoints. If clients can't reach the CRL URL, they may either fail-closed (legitimate certs rejected) or fail-open (revoked certs accepted) depending on configuration. Test CRL accessibility from all clients that will validate certs.
Subordinate CAs let you delegate cert issuance to specific compartments without exposing the root CA. The root CA stays offline / heavily protected; subordinate CAs handle day-to-day cert issuance with their own audit trails. This hierarchy is how mature PKI works.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.