goca

Operator · CAs & Hierarchy

External Parents

Frame 33 of 107

Your root doesn't live in goca — it's an offline ceremony system, an existing enterprise PKI, or another CA product entirely. Do you fake a root to get started? No: parents outside goca are first-class.

Set externalParent: true and the CA parks in pending and hands you a CSR (csrPem in the response, downloadable from the CA card). Have the external parent sign it, then upload the certificate with POST /v1/cas/{ca}/generations/{gen}/certificate.

Upload validation is strict and enforced: real X.509, an actual CA certificate (BasicConstraints), a public key exactly matching the pending key, unexpired, and a CSPRNG serial. Every surface marks such CAs with an "offline parent" chip, so nobody mistakes where trust comes from.

This is also today's honest answer for high-assurance roots: keep the root in your existing ceremony-grade system and chain goca under it. The dedicated offline-root kit is designed but not yet built — frame 35 tells that story straight.

Metaphor: a notarized signature from a registrar in another country — the document is fully valid here; the seal just wasn't made here.
Where it breaks: a notary checks papers once. goca re-verifies the mathematics — the uploaded certificate must match the pending key exactly, or it is refused.

Now I can chain goca under a root it doesn't host.