2.1 Creating a Certificate Authority

When creating a Certificate Authority (CA), you should choose a server that is highly available and highly reliable, then follow this procedure:

  1. Determine that a CA does not already exist by calling NPKIFindOrganizationalCA, which returns an error if the CA does not exist.

  2. Call NPKIGetServerUTCTime to get the current time on the server that will host the CA.

  3. Call NPKIGetServerInfo and NPKIGetAlgorithmInfo to determine the key sizes, algorithms, and validity dates that are supported on the server.

  4. Determine the certificate attributes and extensions, then create the certificate by calling NPKICreateOrganizationalCA.

For an example implementation of this task, see CreateCA.