# Letsencrypt & CA **URL:** \ **Category:** Feature Requests\ **Created:** [May 2, 2020, 1:24am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395 "2020-05-02T01:24:20Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 2, 2020, 1:24am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/1 "2020-05-02T01:24:20Z")
Can I use Let’s encrypt in advanced architecture, like I issue certificate for my domain users and verify it by let’s encrypt (email users) like using S/MIME I think I should have something similar to CA [https://github.com/jsha/minica](https://github.com/jsha/minica) gives such a tool but without Online Certificate Status Protocol (OCSP) and certificate revocation list (or CRL ) When I implement these services an authority should verify my root certificate to be able to issue many certificates for the users. The root certificate can be only for a domain name and issue only certificates for the users in the verified domain Not as any CA that can issue certificates for different domains and is verified to do so by checking its infrastructure. ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [May 2, 2020, 1:34am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/2 "2020-05-02T01:34:17Z")
@malkahtani What you are talking about is an enterprise CA backed by a public CA I don’t believe let’s encrypt currently offers this but there are other providers that do In order to issue your own certificates you would need two things from a public CA A intermediate Certificate and a private key You could then sign your own CSRs and issues certificates from that intermediate GlobalSign and a few other paid providers offer this service Also have a look at the Amazon Certificate Services [https://aws.amazon.com/certificate-manager/](https://aws.amazon.com/certificate-manager/) From my personal research the Amazon Option is the most cost effective but others may know of others ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 2, 2020, 2:30am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/3 "2020-05-02T02:30:55Z")
I know that Amazon is the most affordable and it costs $400 a month + $0.75 for each certificate less than a 1,000 approximately $750 a month or $0.35 if more than 1,000 that make it $350.35 a month or $10.001 each month for over 10,000 certificate. Thus, for small business it is costly 400 + 750 = $1,150 a month and for enterprise it is $410.001 a month. I was looking for something free for experiments, practicing, education, something that mocking a real large enterprise scenario in production for free. like trying the https for free from let’s encrypt. ---
**Author:** ![ski192man](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@ski192man](https://community.letsencrypt.org/u/ski192man)\ **Post date:** [May 2, 2020, 2:37am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/4 "2020-05-02T02:37:25Z")
I doubt let’s encrypt will ever issue free subcas, each subca comes with enormous auditing expenses and requirements for equipment such as an HSM, and puts let’s encrypt at risk of being distrusted. Barring any changes to restrictions on technically constrained subcas of course, if the ca/b rules ever change. EDIT: A technically constrained subca would probably be of limited use anyway, because any application that isn’t setup to understand the constraining field would reject the certificate since it would be marked as critical. ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [May 2, 2020, 2:39am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/5 "2020-05-02T02:39:12Z")
the best option in my opinion is either cfssl or smallstep ca for education – would you like a tutorial as that’s what i am running as an internal ca for our stuff 😃 ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 2, 2020, 3:15am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/6 "2020-05-02T03:15:14Z")
I will be grateful, if you shared such a tutorial. ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 15, 2020, 9:36pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/7 "2020-05-15T21:36:59Z")
![ca_not](https://global.discourse-cdn.com/letsencrypt/original/3X/e/6/e6e795a86e7f33d209b4a664506cc28e59a862d4.png) I installed SmallStep but I have a question Does [https://smallstep.com/](https://smallstep.com/) sign the root certificate and get rid of of warning sign? OR can I sign this certificate from someone else and make this site trusted? ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [May 15, 2020, 10:48pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/8 "2020-05-15T22:48:50Z")
@malkahtani You create the root certificate authority and then the intermediate and then the leaf certs Have a look here [https://smallstep.com/docs/getting-started/](https://smallstep.com/docs/getting-started/) Also note you will need to import your certificates into you trust store ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 3:27am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/9 "2020-05-16T03:27:53Z")
Yes, I still have problem with the Root Certificate because I still see the intermediate certificate as the signing one for the sub-domains. I do not know how to get the root certificate in the trusted store or validate it with Step Online CA. admin@ca:~ step certificate inspect --short (step path)/certs/root\_ca.crt X.509v3 Root CA Certificate (ECDSA P-256) [Serial: 2382…7164] Subject: [ca.int-soft.com](http://ca.int-soft.com) Root CA Issuer: [ca.int-soft.com](http://ca.int-soft.com) Root CA Valid from: 2020-05-16T02:18:14Z to: 2030-05-14T02:18:14Z admin@ca:~ step certificate inspect --short (step path)/certs/intermediate\_ca.crt X.509v3 Intermediate CA Certificate (ECDSA P-256) [Serial: 2109…9290] Subject: [ca.int-soft.com](http://ca.int-soft.com) Intermediate CA Issuer: [ca.int-soft.com](http://ca.int-soft.com) Root CA Valid from: 2020-05-16T02:18:24Z to: 2030-05-14T02:18:24Z admin@ca:~ step certificate inspect https://ca.int-soft.com --short --roots (step path)/certs/root\_ca.crt X.509v3 TLS Certificate (ECDSA P-256) [Serial: 4410…9459] Subject: Step Online CA [ca.int-soft.com](http://ca.int-soft.com) Issuer: [ca.int-soft.com](http://ca.int-soft.com) Intermediate CA Valid from: 2020-05-16T02:39:07Z to: 2020-05-17T02:39:07Z ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 3:35am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/10 "2020-05-16T03:35:01Z")
I issued another one for [https://sec.int-soft.com:9443/](https://sec.int-soft.com:9443/) and it gives me the same warning which similar to the keytool , Keystore file , keystore.jks in JAVA or Certificate Manager tool in Windows ---
**Author:** ![SilverbackNet](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/silverbacknet/32/1032_2.png) [@SilverbackNet](https://community.letsencrypt.org/u/SilverbackNet)\ **Post date:** [May 16, 2020, 4:28am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/11 "2020-05-16T04:28:26Z")
> [@malkahtani](#): > > Yes, I still have problem with the Root Certificate because I still see the intermediate certificate as the signing one for the sub-domains. I do not know how to get the root certificate in the trusted store or validate it with Step Online CA. The intermediate is the signing certificate. You can include the root in the chain if you want, but there's no reason to; the browsers will trust or not trust their own set of roots, and your inclusion won't change that. The process is, root signs intermediate, intermediate signs your site certificate. There's no reason to have a root involved in your cert. Adding the LE root to a trusted store for a legacy OS/application is a separate thing. Is that what you need? ---
**Author:** ![SilverbackNet](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/silverbacknet/32/1032_2.png) [@SilverbackNet](https://community.letsencrypt.org/u/SilverbackNet)\ **Post date:** [May 16, 2020, 4:36am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/12 "2020-05-16T04:36:55Z")
Sorry, I just looked at your [https://ca.int-soft.com](https://ca.int-soft.com) and it’s using a self-signed certificate, not even using LE at all. Are you sure you ran certbot for that site? 9443 doesn’t connect. ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 5:01am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/13 "2020-05-16T05:01:23Z")
I used LE in the link [https://int-soft.com/](https://int-soft.com/) But I am trying to have a CA and get the root certificate verified; so I can have a certificate for the mail server, the openldap, and each user in the openldap,…etc. However, I do not know how to get the CA root certificate signed. I know how to generate signing request for a domain and get it signed from CA but the signing request for CA and get it signing from public CA like Obtain the VeriSign Class 3 Public Primary Certification or something similar. ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 5:21am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/14 "2020-05-16T05:21:02Z")
IF this solution does not work from smallstep, I might try [https://blog.cloudflare.com/introducing-cfssl/](https://blog.cloudflare.com/introducing-cfssl/) from cloudflare ---
**Author:** ![SilverbackNet](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/silverbacknet/32/1032_2.png) [@SilverbackNet](https://community.letsencrypt.org/u/SilverbackNet)\ **Post date:** [May 16, 2020, 5:52am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/15 "2020-05-16T05:52:47Z")
Oh, you need private PKI; LE doesn’t offer that in any way, shape, or form. LE will never give you a signing certificate, period. LE will give you a wildcard cert with the DNS challenge that you could reuse internally, on every device (or alternately map internal names to external ones just to create individual certs), but it’s a fragile solution unless you can completely automate updating certs on every single internal device that uses them. Whereas if you just create your own internal CA, you can do whatever you want with it, sign anything at any time for as long as you like, set up your own internal ACME server if you like, and never have to worry about outsiders knowing your hostnames. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [May 16, 2020, 9:05am UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/16 "2020-05-16T09:05:55Z")
> [@SilverbackNet](#): > > Whereas if you just create your own internal CA, you can do whatever you want with it, sign anything at any time for as long as you like, set up your own internal ACME server if you like, and never have to worry about outsiders knowing your hostnames. The OP already did. > [@malkahtani](#): > > But I am trying to have a CA and get the root certificate verified; so I can have a certificate for the mail server, the openldap, and each user in the openldap,…etc. However, I do not know how to get the CA root certificate signed. I know how to generate signing request for a domain and get it signed from CA but the signing request for CA and get it signing from public CA like Obtain the VeriSign Class 3 Public Primary Certification or something similar. Hi @malkahtani, As @ahaw021 previously said, Public Trusted CAs will not sign your CA certificate for free. So if you want to trust your CA (i.e. dismiss the unknown CA warning), you need to import the root CA certificate to your computer trust store. This is a old tutorial on how to import a CA certificate. > **[Installing Self-Signed CA Certificate in Windows](https://community.spiceworks.com/how_to/1839-installing-self-signed-ca-certificate-in-windows)** > > If you are using a domain CA and don't want the hassle of getting a certificate warning everytime you use the website with the self-signed certificate. Honestly, it's just like how you import a trusted S/MIME or client authorization certificate to Windows. Just a different category. ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 10:44pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/17 "2020-05-16T22:44:57Z")
This way, it will be trusted only for me and people in my organization, not everyone around the world. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [May 16, 2020, 10:58pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/18 "2020-05-16T22:58:21Z")
That is correct. Again, there’s no free ride to Publicly Trusted CA. Running a CA seems to be easy, but it costs a lot in reality to be in compliance for CA/B regulations. (And you also need to comply with Root CA programs) ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 11:14pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/19 "2020-05-16T23:14:39Z")
I know it is only signing the root certificate and it become trusted around the world. What are the cheapest provider for signing the root certificate and how to do it? ---
**Author:** ![malkahtani](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@malkahtani](https://community.letsencrypt.org/u/malkahtani)\ **Post date:** [May 16, 2020, 11:15pm UTC](https://community.letsencrypt.org/t/letsencrypt-ca/121395/20 "2020-05-16T23:15:29Z")
I want my testing and development environment similar to the production environment. [Next page](https://community.letsencrypt.org/t/letsencrypt-ca/121395.md?page=2)