PAM

Certificate Authority

CoreLink operates a per-tenant SSH Certificate Authority as well as a full X.509 PKI hierarchy for TLS. When a user connects to a session target, the system generates an ephemeral Ed25519 key pair, signs it with the tenant CA, and provisions the certificate with configurable extensions (port forwarding, agent forwarding, PTY allocation). X.509 certificates support the full ACME protocol for automated issuance and renewal.

Constrained CAs use RFC 5280 X.509 Name Constraints to bind an intermediate CA to a specific DNS suffix, IP range, or email domain -- delegating issuance authority without risk of overreach. The CA private key is stored encrypted in your KMS or HSM, ensuring it never exists in plaintext outside the device boundary. OCSP responder and CRL distribution points are hosted automatically for revocation checking.

Certificate Authority screenshot

Key Configuration

  • CA key algorithm (Ed25519 for SSH, RSA-2048/4096 or EC P-256/P-384 for X.509)
  • Certificate validity duration
  • Allowed SSH extensions (port forwarding, agent forwarding, PTY allocation)
  • X.509 Name Constraints (DNS, IP, email)
  • OCSP responder URL and CRL distribution point
  • Principal mapping rules
All documentation Question about this? Talk to us