PKI

Manages the router's PKI store — the certificates and keys other features (IPsec, OpenVPN, HTTPS, HAProxy) reference by name. Tabs: Certificates, Certificate Authorities, Key Pairs, DH Parameters, OpenSSH keys, OpenVPN shared secrets, and X.509 Defaults.

Tables show what material is present per entry — certificate, private key, public key — along with flags like revoked, password-protected or ACME-managed. A detail view per row shows the stored objects; secret material is only revealed on explicit request.

With PKI write permission you can:

• Generate on the router — CAs, certificates (optionally signed by a stored CA, pre-filled from the X.509 defaults), key pairs, DH parameters, OpenSSH keys and OpenVPN shared secrets are generated by VyOS itself via the API; private keys are created on the router.
• Add existing material through the same dialogs.
• Edit and delete entries, with delete confirmation.
• Edit X.509 defaults — country, state, locality, organization used to pre-fill certificate generation.