Skip to main content
In this section, we will log in to CryptoHub, create an X.509 Certificate Container, generate a root CA, and issue a leaf certificate.

​
Log in to the CryptoHub web UI

1
Go to the hostname or IP address of the CryptoHub web UI in your browser.
2
Log in with your administrator users.

​
Create an X.509 Certificate Container

1
Go to PKI and CA > Certificate Management.
2
Select [ Add CA ].
3
In the X.509 Certificate Container creation dialog, configure the following settings:
  • Name: Windows Certificate Store
  • Host: None
  • Type: X.509
  • Owner group: Select the Windows Certificate Store role created for the service

​
Generate a root CA certificate

1
Right-click the certificate container you created and select Add Certificate > New Certificate.
2
Configure the following Subject DN settings:
  • Preset: Classic
  • Common Name: Root
3
Configure the following Basic Info settings:
  • Profile: Select Certificate Authority
4
Select [ OK ].

​
Issue a leaf certificate

1
Right-click the Root CA certificate and select Add Certificate > New Certificate.
2
Configure the following Subject DN settings:
  • Preset: Classic
  • Common Name: Leaf
3
Configure the following Basic Info settings:
  • Leave the fields set to the default values.
4
Configure the following V3 Extensions settings:
  • Profile: Select TLS Client Certificate
5
Select [ OK ].

​
Export the certificates

1
Right-click the Root CA certificate and select Export > Certificate(s).
2
Change Encoding to PEM and select [ Browse ].
3
Specify a filename for web transfer (e.g., leaf-cert.pem) and select [ OK ].
4
Select [ OK ] to initiate the export.
5
When prompted, save the certificate file.
6
Repeat steps 1-5 for the Leaf certificate.

​
Assign names to the private keys

1
Go to Key Management > Key Database.
2
Right-click the Leaf key pair in the Keys section and select Edit.
3
Under Key Settings, enter “Leaf” in the Name field and select [ OK ] to save.
4
Right-click the Root key pair in the Keys section and select Edit.
5
Under Key Settings, enter “Root” in the Name field and select [ OK ] to save.

​
Give the Windows Certificate Store role permissions to use the private keys

1
Go to Key Management > Key Database.
2
Right-click the Leaf key pair in the Keys section and select Permission.
3
Select Service - Windows Certificate Store in the dropdown menu and select [ Add ].
4
Grant the Use permission and select [ Save ].
5
Repeat steps 1-4 for the Root key pair.