====== 4.6 Certificate Management ======

Management of PQ certificates.

===== Certificate Types =====

^ Type ^ Location ^ Rotation ^
| Server Certificate | %CERTS_PATH%\server.pfx | Annually |
| Root CA | %CERTS_PATH%\CA\root-ca.crt | 10+ Years |
| Client Certificates | Issued via CA | Annually |

===== Renew Server Certificate =====

<code powershell>
# 1. Request new certificate
# 2. Update proxy configuration
# 3. Restart proxy service

Restart-Service "DataGatewayProxy"
</code>

===== Issue Client Certificates =====

<code powershell>
# Receive CSR from client
# Sign certificate
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
    -CAcreateserial -out client.crt -days 365
</code>

===== Revocation =====

<code powershell>
# Revoke certificate
openssl ca -revoke client.crt -keyfile ca.key -cert ca.crt

# Update CRL
openssl ca -gencrl -out ca.crl -keyfile ca.key -cert ca.crt
</code>

===== Trust Server =====

The central Trust Server validates certificates:

<code>
POST https://trust.intern/api/validate
{
  "certificate": "base64-encoded-cert",
  "purpose": "client-auth"
}
</code>

Response:
<code javascript>
{
  "valid": true,
  "subject": "CN=developer1",
  "issuer": "CN=Internal CA",
  "expiresAt": "2025-12-31T23:59:59Z"
}
</code>

===== PQ-Crypto Library =====

For programmatic certificate management with PQ support see:

  * [[..:..:..:..:..:pqcrypt:developer:beispiele:zertifikat-verwaltung:start|Detailed Guide: Certificate Management]]
  * [[..:..:..:..:..:pqcrypt:api:wvds-system-security-cryptography:x509certificates:x509storeextensions|X509Store Extensions]]
  * [[..:..:..:..:..:pqcrypt:api:wvds-system-security-cryptography:x509certificates:certificaterevocationlistextensions|CRL Extensions]]
  * [[..:..:..:..:..:pqcrypt:developer:beispiele:pki-aufbau:start|PKI Setup with PQ]]