12.2 OCI Certificates: Private CAs, TLS Certificates, Renewal & Integrations

Why Certificate Management Is a Security Objective

TLS protects data in transit, but expired or mismanaged certificates cause outages and security gaps. The exam objective "application and data security using WAF, Certificates, and KMS" expects you to know how OCI issues, stores, renews, and revokes certificates for internal and external services.

Core Concepts

For a certificate to be trusted, the client validating it must trust the root CA at the top of its chain. The service does not support mixed chains in which some certificates use RSA keys and others use ECDSA keys; Oracle recommends separate CA chains for each key algorithm family.

What You Can Do With the Service

Oracle lists these lifecycle capabilities:

• Create root CAs, subordinate CAs, and subordinate CAs that are issued externally but managed internally, as well as certificates and CA bundles.
• Import CAs and certificates issued by a third-party CA.
• Configure rules for how long CAs and the certificates they issue are valid.
• Configure rules to renew certificates automatically.
• Choose which version of a CA, certificate, or bundle is current.
• Revoke a CA or certificate version that has been compromised.
• Tag resources and associate certificates with services such as Load Balancer.

Building a Private CA Hierarchy

Many organizations need certificates for internal services, such as internal web portals, service-to-service TLS, or private API endpoints, that should not be issued by a public CA. The Certificates service lets you run a private PKI:

1. Create or choose a Vault key. Creating a CA requires an HSM-protected asymmetric key (for example, RSA) in OCI Vault. The CA's private key never leaves the HSM.
2. Create a root CA with a long validity period. Oracle's tutorials recommend keeping the root separate from day-to-day issuance.
3. Create a subordinate (issuing) CA signed by the root. Separating root and issuing CAs increases security, because the root can stay unused while the subordinate issues certificates.
4. Issue certificates from the subordinate CA for internal hostnames.
5. Distribute the CA bundle (root and intermediate) to clients so they trust the internal certificates.

A dynamic group and IAM policies are typically used so instances or applications can retrieve certificate bundles without user credentials.

Issued vs. Imported Certificates and Renewal

When a certificate expires without automatic renewal creating a new version, it can no longer be used. Monitoring expiration dates of imported certificates is therefore an operational must.

Versions

Each renewal creates a new certificate version. You can choose which version is current, which allows controlled rollouts and rollback. A compromised version can be revoked, and revocation is published through the CA's CRL.

Integrations

• Load Balancer: associate a certificate from the Certificates service with a listener so the load balancer terminates TLS with a managed certificate.
• API Gateway: use managed certificates for custom domain names on gateways.
• Resource Manager private endpoints: when Resource Manager connects to a private Git server, the server's SSL certificate is imported into the Certificates service.
• Network Firewall and WAF: TLS keys for firewall decryption use Vault mapped secrets; WAF inspects traffic after the load balancer terminates TLS.

Operational Practices

• Prefer certificates issued and managed by the service for internal endpoints, so renewal rules replace them automatically.
• Keep an inventory of imported certificates and their expiry dates, because they must be renewed by hand.
• Use separate subordinate CAs for different environments, such as production and test, so a compromised test CA can be revoked without touching production.
• Set validity rules that match your policy, for example short-lived leaf certificates with automatic renewal.

Security and Monitoring

• IAM controls who and which services can use CAs, certificates, and bundles.
• OCI Audit tracks administrative actions on CAs, certificates, and CA bundles.
• Cloud Guard detects risky configurations and activity related to Certificates. Its activity detectors include rules such as "Certificate Authority (CA) deleted", "Intermediate Certificate Authority (CA) revoked", and "CA bundle updated".