How to create, import, renew, and use certificates and keys on Korthveil, for the web console, VPNs, RADIUS and NAC, and services. Everything is under System › Certificates. Certificates are stored in Korthveil's own database. Which service uses which certificate is configuration, which you save and commit like any other change.

1. What you can do

You want	Use	Where the private key comes from
A certificate browsers trust for the web console, from a public CA	Let's Encrypt (ACME)	Made on the firewall, renewed automatically
A certificate from your registrar or a commercial CA	Signing request (CSR), then Import from your registrar or CA	Made on the firewall; never leaves it
To install a certificate you already have (zip, tar.gz, pfx, pem)	Import from your registrar or CA	In the bundle
Your own private PKI for internal services, Wi-Fi (NAC), VPN users	Create a local CA, then Issue from a local CA	Made on the firewall
A quick test certificate	Self-signed	Made on the firewall

Keys are generated on the firewall: ECDSA P-256 by default, or P-384, RSA 2048, or RSA 3072, all FIPS-approved. A key is never shown or exported. The one exception is a device certificate (use: Client), which can be downloaded once as a password-protected .p12 to install on a laptop or phone (§5).

2. Using a certificate (deployment)

Choosing a certificate is a setting:

Web console: System › Certificates › Web console. The web server switches to it within ten minutes of the commit.
NAC / RADIUS: the NAC add-in's RADIUS server certificate and the CA of the devices' certificates (see NAC and Enterprise Wi-Fi).
NTS time server, syslog over TLS, directory (LDAP) CAs, VPNs: each service's page has a certificate selector.

Renewals deploy themselves:

Issue from a local CA with Renew automatically, and Let's Encrypt, renew 30 days before expiry with a new key. Every service that uses the certificate switches to the new one without a commit.
Imported certificates are renewed by importing the new bundle with Replace a certificate of the same name ticked. Everything using that name gets the new certificate on the next commit.

The Used by column shows where each certificate is in use. A certificate that is in use cannot be deleted.

Let's Encrypt (ACME) needs no purchase. It proves the domain through Cloudflare DNS (DNS-01) or HTTP, and renews by itself:

3. Buying a certificate: CSR, then the registrar's bundle

Add a certificate › Signing request (CSR): enter a name (e.g. www.example.com), the common name, and DNS names, then click Create. The firewall makes the private key and the request.

Click CSR in the Store row to download www.example.com.csr, and paste or upload it at your registrar or CA.
When they send the certificate, usually a .zip, use Import from your registrar or CA, choose the file, and click Import. Korthveil recognises it as the answer to your request (by its key) and completes it. The key never left the firewall, so the bundle has no key, and that is expected.
Choose it for the web console, or wherever it is needed, and commit.

4. Importing a bundle as it came

Import from your registrar or CA takes the download exactly as it came:

Accepted formats: .zip, .tar.gz/.tgz, .tar, or a single .pfx/.p12, .pem, .crt, .cer, .ca-bundle, or .key file, up to 8 MB.
What it does:
reads every file in it: PEM certificates and keys, DER certificates, and PKCS#12 files (give the PFX/P12 password for those);
finds the server certificate, pairs it with its private key by public key, and orders the chain as leaf, then intermediates;
leaves out the root, which devices already trust;
skips files that aren't certificates, such as README.txt and macOS __MACOSX folders.
The name comes from the certificate's first DNS name (*.example.com becomes wildcard.example.com) unless you give one.
No key in the bundle: Korthveil completes the matching CSR made on the firewall. If there is no such CSR, it says what is missing.
Encrypted PEM keys are refused with a note. Export the key unencrypted, or as a .pfx with a password.
The result lists the files read and any notes, for example "left out the root CA …" or "no intermediate CA in the bundle".

5. A private CA for your devices (NAC, VPN)

Create a local CA, e.g. name nac-ca, common name "Korthveil NAC CA". Its key never leaves the firewall and is never downloadable.
Issue from a local CA for the server: e.g. nac-radius, use Server, and DNS name radius.korthveil.lan.
Issue from a local CA for each device: e.g. laptop-1, use Client (VPN users, devices).
In the Store, click .p12 on the device's row. A file laptop-1.p12 downloads, and a password is shown once. Copy it to the device, install it with that password, and delete the file. The download is recorded in the Audit log (certificate.download-key).
Download the CA certificate (the download icon on nac-ca). Devices need it to check the server: on Windows it goes in Trusted Root, on macOS and iOS in the profile, on Android under "CA certificate".

Only Client certificates can be downloaded with their key. Server certificates, CAs, and the web console's certificate cannot.

6. Troubleshooting

Message	Meaning
"a certificate named X exists; choose Replace…"	You imported the same name again; tick Replace for a renewal
"the bundle has no private key for X, and no certificate request on this firewall matches it"	The key was made elsewhere: add the `.key` file, or a `.pfx` with its password
"the private key is encrypted"	Export it unencrypted, or as a .pfx
"only device (client) certificates can be downloaded with their key"	Expected for server certificates and CAs
"certificate in use by …" when deleting	Choose another certificate there first

See also: adr/0026 (certificate store), adr/0057 (bundles, device downloads, certificates for add-ins).