DALTCORE PKI

The private certificate authority for DALTCORE internal services. Install the root certificate below to trust services under daltcore.internal and DALTCORE client certificates.

Verify the SHA-256 fingerprint of the root certificate before you trust it. Only install it on devices that need to reach DALTCORE internal services.

Certificates

Hierarchy

DALTCORE Root CA R2          2026 – 2036
├── DALTCORE TLS CA G2       2026 – 2031
└── DALTCORE Client CA G2    2026 – 2031

Intermediates are only for verifying chains; you do not need to install them. Servers send them along.

Install the root certificate

macOS

curl -fsSLO https://pki.daltcore.com/certs/root-r2.crt
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain root-r2.crt

Or open the profile, then install it in System Settings → General → Device Management.

iOS and iPadOS

Open the profile in Safari and install it in Settings → General → VPN & Device Management. Then turn on full trust in Settings → General → About → Certificate Trust Settings.

Windows

curl.exe -fsSLO https://pki.daltcore.com/certs/root-r2.crt
certutil -addstore -f Root root-r2.crt

Run in an elevated prompt.

Debian and Ubuntu

sudo curl -fsSL https://pki.daltcore.com/certs/root-r2.crt -o /usr/local/share/ca-certificates/daltcore-root-r2.crt
sudo update-ca-certificates

Fedora, RHEL and Rocky Linux

sudo curl -fsSL https://pki.daltcore.com/certs/root-r2.crt -o /etc/pki/ca-trust/source/anchors/daltcore-root-r2.crt
sudo update-ca-trust

Firefox

Firefox uses the system trust store on macOS and Windows when security.enterprise_roots.enabled is on. Otherwise import the root in Settings → Privacy & Security → Certificates → View Certificates → Authorities.

Revocation

Every DALTCORE certificate references its issuer and CRL on this site.

SSH certificate authorities

Hosts and users can carry SSH certificates signed by these keys.

Trust host certificates (~/.ssh/known_hosts)

@cert-authority *.daltcore.internal ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIp1qnANrgtP5VlvOWcIdhJHJLzqf1Dd3vekQ6T9F2DXRjnuR7BqLb89FjE18PlPnAAFN2BruEKBpbsE2e5sJ4A=

Accept user certificates (sshd_config)

TrustedUserCAKeys /etc/ssh/daltcore_user_ca.pub

with ssh-user-ca-g2.pub as that file. Host CA key: ssh-host-ca-g2.pub.

Ceremony log

Every operation with the offline root key. Times in UTC.