Signing an External CA

In some cases, you might want to have one of your CAs signing another external CA. This is typically performed in the following steps:

Assuming both your CA and the external CA are using EJBCA, the set up is performed as described in the following steps.

It is not possible to issue CA certificates using the RA Web in EJBCA 6.x versions. To issue a CA certificate in EJBCA 6.x you need to add an end entity using the CA Web, and then issue the CA certificate through the Public Web. This is the procedure described in the steps below.

Step 1: Create Profiles on Your CA Machine 

It is recommended to create a dedicated certificate profile and an end entity profile for the external CA on your CA machine, instead of using the built-in profiles. The advantage is more flexibility and better management features.

To create a certificate profile and an end entity profile on your CA machine, do the following:

  1. Go to the CA Web, and select the CA Functions > Certificate  Profiles menu option.
  2. Add a new certificate profile, and use "Sub CA" as template by selecting the Type option Sub  CA.
  3. In the Available  CAs list, select the CA that is going to sign the CSR.


  4. Make additional adjustments as required and save the certificate profile.
  5. Select the End Entity Profiles menu option.
  6. Create a new end entity profile. Pick your recently created certificate profile, the CA that is going to sign the CSR and select User Generated as token type:


  7. Make additional adjustments as required and save the end entity profile.

Step 2: Add End Entity

To add an end entity on your CA machine, do the following:

  1. Click the RA Functions > Add  End  Entity menu option.
  2. Add a new end entity using the end entity profile you created in the previous Step 1: Create Profiles on Your CA Machine.

Step 3: Create CSR

To create a CSR on the external CA machine, do the following:

  1. On the external CA machine, go to the CA Web, select the menu option CA Functions > Certificate Authorities, enter Sub  CA in the Add  CA field, and then click Create.
  2. To make this CA an externally signed CA, select the Signed  By option External CA.


  3. To save the CA and create a CSR, click Make Certificate Request.
  4. Save the CSR to for example a USB stick and transfer it to your CA machine.

Step 4: Sign CSR and Issue CA Certificate 

To sign the CSR and issue the CA certificate using the appropriate CA on your CA machine, do the following:

  1. Go to the Public Web on your CA machine, and select the Create Certificate from CSR menu option.


  2. Enroll using the username and enrolment code you specified when adding the end entity. Then save the certificate on for example a USB stick and transfer it to the external CA machine.

Step 5: Import CA Certificate

To import the CA certificate on the external CA machine, do the following:

  1. On the external CA machine, go to the CA Web, select the menu option CA Functions > Certificate Authorities, and edit the CA you signed in the previous Step 4: Sign CSR and Issue CA Certificate.
  2. Upload the CA certificate and click Receive Certificate Response to import the externally signed CA certificate and activate the CA.