Skyrsoft CertOps runs its own internal certificate hierarchy: a self-signed root CA and one or more issuing CAs signed by it. The issuing CA does the day-to-day work — every certificate a template below issues comes from one of these — while the root is created once and touched rarely after that. CertOps also provisions and maintains a second, internal CA purely for agent authentication. It is fully automatic, does not appear in this list, and cannot be repurposed for anything else.
How it works
When more than one CA could plausibly sign a request, CertOps resolves it in a fixed order:
| Order | Source |
|---|---|
| 1 | An approval-time override, chosen by whoever approves the request |
| 2 | The template’s own configured issuing CA |
| 3 | The system default CA |
An approval rule can also pin the CA for the requests it matches, ahead of the template’s own setting. There is no per-request choice outside that order — a template that names an issuing CA always uses it unless an approval overrides it.
Root and issuing CAs
Creating a root asks for a subject DN, a key algorithm (RSA 2048 or 4096, ECDSA P-256 or P-384) and a validity in years, then produces a self-signed trust anchor. An intermediate is created under a parent CA and does the actual issuing; keeping the root itself idle limits what a compromise of the day-to-day CA can reach. One CA can be nominated as the system default, used by any template or approval rule that does not name one explicitly.
Root CA
Skyrsoft Internal Root
Self-signed once, kept idle after that
Issuing CA
Skyrsoft Issuing CA
Signs every certificate a template issues
Certificate
host.internal.example
Issued by the issuing CA, per template
Key storage
CA private keys are held in a DPAPI-protected file store on the CertOps host: DPAPI on Windows, AES-256-GCM against a machine-scoped secret file elsewhere. The key is generated into that store when the CA is created, and it is the only key storage CertOps has.
One installation, many CAs
A Free licence allows one root and one intermediate CA; the internal agent-identity CA never counts against that, and Pro removes the cap entirely. Because a template can point at any registered CA and, independently, at any registered AD domain, one CertOps installation can run a distinct hierarchy per business unit or subsidiary, each with its own issuing CA and its own validation.
Base URL, AIA and CDP
Each CA carries a base URL that is baked into every certificate it issues, as the AIA (where a relying client fetches the CA certificate or does OCSP) and the CDP (where it fetches the CRL). CertOps builds it from the server URL configured in Settings, and refuses to create a CA at all until that is set. Get the hostname right before you issue anything from that CA in production: a certificate already issued keeps the URL it was given.
Limits
Free licences cap the hierarchy at one root and one intermediate CA. The internal agent-identity CA is exempt from that count because it is not a CA you manage.
There is no hardware-backed key storage. CA keys live in the software file store described above and nowhere else; CertOps ships no HSM or TPM option, and a key already generated cannot be moved to different storage without creating a new CA and reissuing what it signed. If your controls require keys that never exist in host memory, CertOps does not meet them.
A CA cannot be deleted while anything still depends on it. That includes subordinate CAs, live certificates it has issued, and any template or approval rule that still references it. Each of those is checked before deletion and returns a conflict naming what is in the way.
The internal agent-identity CA cannot be used for anything but agent identity. An ordinary template pointed at it is refused at the point of issuance, not merely hidden from the console — so there is no way to repurpose it as a convenient extra issuing CA.
The base URL is not validated against reachability. A hostname relying clients cannot resolve will not fail at save time; it fails later, silently, the first time a client tries to fetch the CA certificate or check revocation.