TigerTrust provides a single issuance path that routes to the right CA type based on your selection. The Issue Certificate wizard at Certificates > Issue Certificate is the UI entry point, but the same flow is also available via the API for CI/CD pipelines and workflows.
Certificate Issuance

​
What it is

You choose a CA, optionally apply a template, fill in the subject and SANs, pick a key algorithm and validity, and TigerTrust handles the rest — talking to the CA, storing the certificate, recording the issuance in the audit log, and optionally queuing deployment.

​
When to use it

  • Issue a new TLS certificate for a service that is being launched.
  • Issue a client authentication certificate for a service account or user.
  • Issue a code-signing certificate for a release pipeline.
  • Issue from your internal CA with HSM-backed keys for critical infrastructure.

​
Set it up

1

Open the issuance wizard

Go to Certificates > Issue Certificate.
2

Select a CA

Choose from your connected CAs (internal PKI, Let’s Encrypt, DigiCert, and others). The form adapts to the CA’s capabilities.
3

Apply a template (optional)

Select a certificate template from the dropdown. It pre-fills the key algorithm, key size, key usage extensions, and validity. You can override pre-filled values unless the template locks them.
4

Fill in the subject

Enter the common name and any subject alternative names (DNS, IP, email). The form validates SANs against active policies as you type.
5

Configure the key

Choose RSA, ECDSA, or ED25519 and the appropriate size. For the highest assurance, upload a CSR instead — this keeps the private key on your side and TigerTrust only signs the public key.
6

Set options

Enable Auto-renewal to have the certificate renewed automatically before expiry. Assign an owning identity if this certificate belongs to a specific service account or IoT device.
7

Issue

Click Issue certificate. If a workflow is attached to this CA that requires approval, the request enters a pending state until the required approvers act.

​
What you’ll see

On success, the certificate detail panel opens with the PEM, chain, serial number, and validity dates. If the platform generated the private key, a Download private key button is visible for a one-time download.
The private key is available for download only at issuance time. If you plan to store it in a secret manager, download it now. If you upload a CSR instead, the private key never touches TigerTrust and the download button is not shown.
The new certificate appears immediately in Certificates with status active and its source recorded as the issuing CA type.

​
Bring-your-own CSR

Toggle Upload CSR in the wizard (or pass csr in the API) to bring a pre-generated certificate signing request. TigerTrust signs the public key from the CSR and returns only the certificate and chain — the private key stays on your side.

​
Common built-in templates

TemplateKey usageExtended key usageTypical validity
Web serverdigitalSignature, keyEnciphermentserverAuth90 days
Client authdigitalSignatureclientAuth365 days
Code signingdigitalSignaturecodeSigning365 days
EmaildigitalSignature, keyEnciphermentemailProtection365 days

Certificate authorities

Connect Let’s Encrypt, DigiCert, ADCS, or an internal CA.

Certificate templates

Encode policy-compliant defaults for repeat issuance.

PKI Core

The internal CA that powers internal issuance.