# Manage Certificate Authorities for mTLS authentication on Confluent Cloud You can manage trusted certificate authorities (CAs) for mTLS authentication using the Confluent Cloud Console, Confluent CLI, Confluent Cloud APIs, and Terraform. The following sections describe how to create, describe, update, delete certificate authorities, and how email notifications are sent when certificates in a configured Certificate Authority are approaching expiration. ## Create a Certificate Authority To create a Certificate Authority (CA) to use with X.509 client certificate authentication for mTLS, follow these steps. ### Confluent Cloud Console To create a certificate authority using the Confluent Cloud Console: 1. In the Confluent Cloud Console, go to **Account & access**, then click **Workload identities**. Alternatively, click [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities). 2. Click **Add provider**. The **New identity provider** page displays. 3. Select **Certificate authority** for the authentication type. 4. Enter the following details: | **Name** | Enter a meaningful name for your certificate authority. | |-----------------|---------------------------------------------------------------| | **Description** | (Optional) Enter a description for the certificate authority. | 5. Click **Add PEM file** to upload the Certificate Authority (CA). Provide the certificate chain containing the root and any intermediate CAs used to verify client certificates. For details, see [Requirements for mTLS](configure.md#mtls-requirements). 6. (Optional) Click **Upload CRL file** to upload the Certificate Revocation List (CRL). If the PEM file you uploaded contains the CRL URL, this is auto-populated. You can also manually provide the CRL URL. 7. Confirm your Certificate Authority configuration details. The serial number and SHA-1 fingerprints are provided to let you match the values in your Certificate Authority with the values with your local files. 8. Click **Validate and save**. For details, see: * [Certificate revocation for mTLS authentication on Confluent Cloud](certificate-revocation.md#certificate-revocation-mtls) ### Confluent CLI To create a Certificate Authority using the Confluent CLI, use the following CLI command, replacing `` with the name of the Certificate Authority: ```shell confluent iam certificate-authority create --name [flags] ``` **Example** Create the Certificate Authority “my-ca” using the certificate chain stored in the `CERTIFICATE_CHAIN` environment variable: ```shell confluent iam certificate-authority create my-ca \ --description "my certificate authority" \ --certificate-chain $CERTIFICATE_CHAIN \ --certificate-chain-filename certificate.pem ``` If you are configuring with a Certificate Revocation List (CRL), use `--crl-url "http://domain.certificate-revocation.crl"` or `--crl-chain ""`. ### REST API To create a certificate authority using the REST API, use the following HTTP POST request: ```shell POST https://api.confluent.cloud/iam/v2/certificate-authorities ``` To create a JSON payload for creating a certificate authority, you can use the following example as a template. crl_url is optional, and can be substituted with `--arg crl_chain "$(cat path/to/.pem)"`. ```shell json_payload=$(jq -n \ --arg name "" \ --arg description "" \ --arg certificate_chain "$(cat path/to/.pem)" \ --arg certificate_chain_filename ".pem" \ --arg crl_url "" \ '{ display_name: $name, description: $description, certificate_chain: $certificate_chain, certificate_chain_filename: $certificate_chain_filename, crl_url: $crl_url }'); ``` #### JSON Payload Fields | Field | Description | |---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **display_name** | The name of the certificate authority. Replace `` with
your desired name. | | **description** | (Optional) A description of the certificate authority. Replace
`` with your description. | | **certificate_chain** | The base64 encoded certificate chain. Replace
`` with your certificate chain. | | **certificate_chain_filename** | The filename of the certificate chain. Replace
`` with your filename. | | **crl_url** | (Optional) The URL of the Certificate Revocation List (CRL). Replace
`` with your CRL URL. | | **crl_chain** | (Optional) The Base64-encoded CRL chain. Replace
`` with your CRL chain. | | **require_crl_on_client_certificate** | (Optional) When set to `true`, enables the CRL option and
enforces fail-close CRL checking that is aligned with the OpenSSL
`-crl_check` standard. A client certificate is denied unless it
is issued by the same CA that issued the configured CRL. This
attribute must be enabled for CRL configurations. For details,
see [Certificate revocation for mTLS authentication on Confluent Cloud](certificate-revocation.md#certificate-revocation-mtls). | For details, see the [Create a Certificate Authority (API Reference)](https://docs.confluent.io/cloud/current/ccloud/create-iam-v-2-certificate-authority/). ### Terraform - Use the [confluent_certificate_authority](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_certificate_authority) Terraform resource to create, edit, or delete Certificate Authorities on Confluent Cloud. - Use the [confluent_certificate_pool](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_certificate_pool) Terraform resource to create, edit, or delete Certificate Pool on Confluent Cloud. ## Describe a Certificate Authority To get the details of a certificate authority, follow these steps. ### Confluent Cloud Console To get the details of a certificate authority: 1. In the Confluent Cloud Console, go to **Account & access**, then click **Workload identities**. Alternatively, click [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities). 2. Click the name of the certificate authority. The **Certificate authority details** page displays. ### Confluent CLI > To get the details of a certificate authority, use the following CLI command, > replacing `` with the ID of the certificate authority: > ```shell > confluent iam certificate-authority describe > ``` > For details on the `confluent iam certificate-authority describe` command, > run the following CLI command: > ```shell > confluent iam certificate-authority describe --help > ``` ### REST API To get the details of a certificate authority, use the following HTTP GET request, replacing `` with the ID of the certificate authority: ```shell GET https://api.confluent.cloud/iam/v2/certificate-authorities/ ``` For details, see the [Read a Certificate Authority (API Reference)](https://docs.confluent.io/cloud/current/ccloud/get-iam-v-2-certificate-authority/). ## List all Certificate Authorities To get a list of all Certificate Authorities, follow these steps. ### Confluent Cloud Console To get a list of all Certificate Authorities: 1. In the Confluent Cloud Console, go to **Account & access**, then click **Workload identities**. Alternatively, click [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities). The list of Certificate Authorities is displayed. ### Confluent CLI To get a list of all Certificate Authorities, use the following CLI command: ```shell confluent iam certificate-authority list ``` For details on the `confluent iam certificate-authority list` command, run the following CLI command: ```shell confluent iam certificate-authority list --help ``` ### REST API To get a list of all Certificate Authorities, use the following HTTP GET request: ```shell GET https://api.confluent.cloud/iam/v2/certificate-authorities ``` For details, see the [List of Certificate Authorities (API Reference)](https://docs.confluent.io/cloud/current/ccloud/list-iam-v-2-certificate-authorities/). ## Update a Certificate Authority To update a configured Certificate Authority, follow these steps. ### Confluent Cloud Console To update a Certificate Authority: 1. In the Confluent Cloud Console, go to **Account & access**, then click **Workload identities**. Alternatively, click [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities). 2. Click the name of the Certificate Authority. The **Certificate authority details** page displays. 3. Click **Edit** to update the Certificate Authority details. 4. Update the Certificate Authority details. 5. Click **Save**. ### Confluent CLI To update the description of a Certificate Authority, use the following CLI command, replacing `` with the ID of the Certificate Authority and add any of the following optional arguments: ```shell confluent iam certificate-authority update \ --name "" \ --description "" \ --certificate-chain "" \ --certificate-chain-filename "" \ --output "" ``` For details on the `confluent iam certificate-authority update` command, run the following CLI command: ```shell confluent iam certificate-authority update --help ``` ### REST API To update a Certificate Authority, use an HTTP PUT request to [https://api.confluent.cloud/iam/v2/certificate-authorities/ca-id](https://api.confluent.cloud/iam/v2/certificate-authorities/ca-id), replacing `` with the ID of the Certificate Authority and adding the fields to update. For example, you can update the CRL manually using a local CRL file, replacing `` with the Base64-encoded CRL chain: ```shell json_payload=$(jq -n --arg crl_chain \ "$(cat .pem)" \ '{crl_chain: $crl_chain}'); ``` For details, see the [Update a Certificate Authority (API Reference)](https://docs.confluent.io/cloud/current/ccloud/update-iam-v-2-certificate-authority/). ## Delete a Certificate Authority To delete a Certificate Authority, follow these steps. #### IMPORTANT Before deleting a Certificate Authority, you must delete any identity pools that reference the Certificate Authority. ### Confluent Cloud Console To delete a Certificate Authority: 1. In the Confluent Cloud Console, go to **Account & access**, then click **Workload identities**. Alternatively, click [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities). 2. Click the name of the Certificate Authority that you want to delete. The **Certificate authority details** page displays. 3. Click **Edit**. 4. At the bottom of the page, click **Delete certificate authority**. After confirming the deletion, the Certificate Authority is deleted. ### Confluent CLI To delete a Certificate Authority, use the following CLI command, replacing `` with the ID of the Certificate Authority: ```shell confluent iam certificate-authority delete ``` For details on the `confluent iam certificate-authority delete` command, run the following CLI command: ```shell confluent iam certificate-authority delete --help ``` ### REST API To delete a Certificate Authority, use the following HTTP DELETE request, replacing `` with the ID of the Certificate Authority: ```shell DELETE https://api.confluent.cloud/iam/v2/certificate-authorities/ ``` For details, see the [Delete a Certificate Authority (API Reference)](https://docs.confluent.io/cloud/current/ccloud/delete-iam-v-2-certificate-authority/). ## Email notifications As certificates in a configured Certificate Authority approach their expiration dates, email notifications, titled “Action Required: Update expiring certificate authority”, are sent to principals with the [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role. These email notifications are sent progressively more often (60 days, 30 days, 7 days, 3 days, 2 days, and 1 day before expiration) until the Certificate Authority is updated. If all certificates in a configured Certificate Authority are expired, then any client certificates intended to authenticate with the expired Certificate Authority fail. ## Related content * [Certificate Authorities (API Reference)](https://docs.confluent.io/cloud/current/ccloud/certificate-authorities-iam-v-2/) * [Manage Certificate Identity Pools for mTLS authentication on Confluent Cloud](identity-pool.md#manage-identity-pool-mtls) * [Use Mutual TLS (mTLS) to Authenticate to Confluent Cloud Resources](overview.md#mtls-overview) * [Troubleshoot Mutual TLS (mTLS) issues in Confluent Cloud](troubleshoot.md#troubleshoot-mtls)