Certificate Requirements
When you issue a certificate signed by your own CA, you must meet the following requirements:
- The encoding must use UTF8String.
- You must use the same character encoding for all certificates in your certificate chain.
- The “Subject Name” in the CSR file downloaded from Secure Access must be honored.
- The certificate must be valid for no more than three years.
- The certificate must be an X509v3 certificate with an RSA public key not less than 2048 and no more than 4096.
- Use one of the following signature algorithms:
- SHA256withRSA
- SHA384withRSA
- SHA512withRSA
- Include the following X509v3 extensions:
- X509v3 Basic Constraints marked as critical: CA:TRUE
- X509v3 Key Usage, marked as critical: Certificate Sign, CRL Sign