A certificate authority (CA) signs certificates that clients or servers can verify. Nokku stores CA private keys in the core and exposes the corresponding public trust material to the components that need it.
Authority types
| Type | Used for |
|---|---|
| SSH | OpenSSH user and host certificates |
| X.509 | TLS client and server certificates |
Workspace creation provides a default SSH CA. X.509 CAs are created separately.
Key types
Nokku supports Ed25519, ECDSA, and RSA keys where allowed by the authority policy. RSA keys must be at least 2048 bits. The exact allowed key types are part of the CA configuration.
Certificate lifetimes
Authorities have separate defaults and maximums for user and host certificates. A request with no TTL uses the configured default. A request outside the allowed range uses the authority default.
The CA’s own lifetime is separate from the lifetime of certificates it signs.
SSH CA policy
SSH authorities can define user certificate extensions and critical options. These settings become part of issued user certificates and should be reviewed as security policy, not treated as display metadata.
Rotation
CA rollover replaces the CA material and sends a certificate update notification to connected daemons. Plan rotation as a trust change: clients and servers must receive the new public CA material, and certificates signed only by the old CA may no longer be accepted after the transition.
Verify the target and client state after rotation before removing any old trust material.