Docs

Certificate Center

Private root CA

Uploading a root CA certificate

You can upload root CA certificates exported from third-party service providers to the VolcanoEngine Certificate Center for unified management.

Prerequisites

Private CA service enabled. For related operations, see Enabling a private CA service.

Root CA certificate to be uploaded is ready. The root CA certificate must be in PEM format (with corresponding file extensions .crt or .pem).

(Optional) The private key file corresponding to the root CA certificate is ready.

When uploading a root CA certificate, you can optionally upload the associated private key file. The private key file must be in PEM format (with corresponding file extensions .key or .pem) and must not have password protection enabled.

Procedures

In the left navigation pane, select Private CA > Private Root CA.

On the Private root CA page, click Upload root CA certificate.

On the Upload root CA certificate page, follow the instructions below to complete the configuration, then click Confirm.

Configuration item	Notes
Upload method	Select an upload method. Options: File upload: Select the local file to upload. manual input: Paste the file content to upload.
Certificate file	If the Upload method is File upload, choose one way to upload the certificate file: Click the add icon, then select the certificate file. Drag and drop the certificate file into the file upload area. If the Upload method is Manual input, paste the certificate content into the input box. The certificate content starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. warning Uploading duplicate root CA certificates is not allowed.
Certificate private key file	If the Upload method is File upload, choose one way to upload the private key file: Click the add icon, then select the private key file. Drag and drop the private key file into the file upload area. If the Upload method is Manual input, paste the private key content into the text box. if the key algorithm is RSA, the private key content starts with -----BEGIN RSA PRIVATE KEY----- and ends with -----END RSA PRIVATE KEY-----. if the key algorithm is ECC, the private key content starts with -----BEGIN EC PRIVATE KEY----- and ends with -----END EC PRIVATE KEY-----. tip If you want to use an uploaded root CA to issue sub CA certificates, you must upload the private key. If the root CA is only used for cloud product deployment, it is not necessary to upload the private key.
Remark	To identify or describe root CA certificates, set remarks for it.
Belongs to Project	Select the project to which the uploaded private root CA belongs. If no project is selected, it defaults to the default project. tip If the required project is not found, click Create project to create a new project on the project management page. You can also assign the private root CA to a specific project after successful upload and creation. For detailed steps, see Modifying the resource project.
Tag	Click Add tag to add one or more tags (in key-value pair format) for the uploaded private root CA. With tags, you can classify, search, and control permissions for private root CAs from different dimensions, enhancing the flexibility of resource management.

After completing the above steps, you can view the uploaded root CA certificate in the private root CA list (Certificate source is Upload hosting).

Last updated: 2026.04.01 10:55:26