1# CA Commands
2
3Manage Gordon's internal Certificate Authority.
4
5## gordon ca
6
7### Subcommands
8
9| Subcommand | Description |
10|------------|-------------|
11| `export` | Export the root CA certificate in PEM format |
12| `info` | Show CA status (root CN, fingerprint, intermediate expiry) |
13| `install` | Install/uninstall the root CA in system trust stores |
14
15All subcommands require `server.tls_port` to be non-zero in the Gordon configuration.
16
17---
18
19## gordon ca export
20
21Export the root CA certificate for manual trust installation on clients.
22
23```bash
24gordon ca export                  # Print PEM to stdout
25gordon ca export --out ca.pem     # Write to file
26```
27
28### Options
29
30| Option | Description |
31|--------|-------------|
32| `--out` | Write certificate to file instead of stdout |
33
34---
35
36## gordon ca info
37
38Show CA status information: root common name, SHA-256 fingerprint, and intermediate certificate expiry.
39
40```bash
41gordon ca info
42gordon ca info --json
43```
44
45### Options
46
47| Option | Description |
48|--------|-------------|
49| `--json` | Output as JSON |
50
51### JSON Output
52
53```json
54{
55  "root_cn": "Gordon Internal Root CA",
56  "fingerprint": "SHA256:AB:CD:...",
57  "intermediate_expiry": "2026-07-01T12:00:00Z",
58  "intermediate_ttl": "2160h0m0s"
59}
60```
61
62---
63
64## gordon ca install
65
66Install or uninstall the root CA certificate in system, Firefox, and Java trust stores on the **Gordon host machine**. Requires root privileges.
67
68```bash
69sudo gordon ca install
70sudo gordon ca install --uninstall
71```
72
73### Options
74
75| Option | Description |
76|--------|-------------|
77| `--uninstall` | Remove the CA from trust stores instead of installing |
78| `--json` | Output as JSON |
79
80> **Important:** This command is for the machine running Gordon, not for arbitrary clients. Remote users should import the certificate through one of the methods below.
81
82---
83
84## Client Trust Setup
85
86Clients that connect directly to Gordon's HTTPS port need the root CA certificate in their trust store. Gordon provides the certificate through a browser-accessible onboarding page at `https://<gordon-host>/.well-known/gordon/ca`, or over plain HTTP at `http://<gordon-host>/.well-known/gordon/ca` for first-time setup.
87
88### Firefox / Zen (NSS certificate store)
89
90Firefox and Zen use their own certificate store, separate from the OS.
91
921. Open `https://<gordon-host>/.well-known/gordon/ca.crt` — Firefox will prompt to import the certificate.
932. Check **Trust this CA to identify websites** and confirm.
94
95Alternatively, import manually: **Settings > Privacy & Security > Certificates > View Certificates > Import**.
96
97### Linux System Trust Store
98
99```bash
100# Download the certificate
101curl -k https://<gordon-host>/.well-known/gordon/ca.crt -o gordon-ca.pem
102
103# Debian / Ubuntu
104sudo cp gordon-ca.pem /usr/local/share/ca-certificates/gordon-ca.crt
105sudo update-ca-certificates
106
107# Fedora / RHEL
108sudo cp gordon-ca.pem /etc/pki/ca-trust/source/anchors/gordon-ca.pem
109sudo update-ca-trust
110```
111
112### Mobile Devices (iOS / Android)
113
114Visit `http://<gordon-host>/.well-known/gordon/ca` from the device browser. The onboarding page offers:
115
116- **iOS:** Download the `.mobileconfig` profile, then install it in **Settings > General > VPN & Device Management**.
117- **Android:** Download `ca.crt`, then install it in **Settings > Security > Encryption & credentials > Install a certificate**.
118
119---
120
121## Related
122
123- [Server Configuration](../config/server.md) — `tls_port`, `force_https_redirect`, and internal CA settings
124- [CLI Commands](./index.md)