Create your private CA
Start with a root certificate authority. Add intermediate signing CAs for server, device, user, or VPN certificates as you need them.
Your private certificate authority, made simple.
Create root and intermediate CAs, then issue, export, renew, and revoke certificates for your servers, devices, users, and VPN clients. Manage your private PKI from one clear web interface.
Passphrase-protected private keys. Setup guidance included.YOUR CERTIFICATE WORKSPACEPrivate
Your private CA, at a glance.
Intermediate signing CAIssue certificates for a specific purpose
ServersDevicesUsers
Authorities, certificates, and keys. One workspace.
Issue and export certificates
Choose names, validity, and subject alternative names (SANs). Download certificates, encrypted private keys, and chains for your applications.
Renew and revoke certificates
Check expiry status, renew certificates, and revoke identities you no longer trust. Export signed certificate revocation lists (CRLs) for your services to check.
Private certificates for the systems you run
Set up internal TLS certificates for a homelab or private services, or issue client certificates for device, user, and VPN authentication. CA Master brings your authorities and certificates together so you can manage them in one place.
- Will browsers automatically trust my certificates?
- CA Master creates a private PKI (public key infrastructure). Install and trust your root certificate on the systems that should accept your certificates.
- How are my private keys protected?
- Private keys are stored encrypted with their passphrases. Keep your passphrases and encrypted key backups safe: CA Master cannot recover a lost private key passphrase.
- Which certificate formats can I export?
- Export certificates as PEM or DER, along with encrypted private keys and certificate chains. Password-protected PKCS#12 bundles are available for chains that use RSA throughout.