Creating New Cert from local trusted root CA

[MP18]

i have local trusted root CA on the PA.

Also i have ssl decryption cert on the PA.

Is it possible i can create new cert from root and use it for web gui?

[Abdul_Razaq]

You can generate a new certificate for GUI as well, but you need not to. you can use the same root cert for GUI as well. call it under ssl/tls service profile. use it under management configuration.

[MP18]

it do not work.

under ssl/tls profile the CA root ceret does not show up?

[Abdul_Razaq · Accepted solution]

Do you have private key of same certificate inside PA ? . then only you can use the certificate for web access

[MP18]

No CA root cert has no private key checked.

[MP18]

any one can answer this?

[gwesson · Accepted solution]

Abdul eluded to it - you can't generate a new cert from that root without the private key. If that was a thing you could do, you could just grab GoDaddy or Letsencrypt's public root cert and create a valid cert for any domain. It's a fundamental part of PKI - ff you don't have the private key, you can't sign a new cert issued by that CA.

[MP18]

Many thanks for answering the question.

[Remo]

Besides the fact that the whole trust system of the PKI wouln't work if everyone could sign certs with a publoc key, the money-making machine of the public CA also wouln't work 😉