# Quickstart

Create a root CA, an issuing CA, and an enrollment endpoint.

Complete first-run setup using the one-time setup URL printed by your SimpleSCEP deployment. The first user is an administrator.

## 1. Configure your Root CA

Open Certificate Authorities.

Click **Configure Root CA**.

![The Configure your Root CA dialog](/assets/docs/quickstart-add-root.png)

Only administrators can create the root CA.

The **Configure your Root CA** dialog asks for:

| Field                                                | Notes                                                                                                         |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| CA name                                              | Label shown in the console. Not part of the certificate                                                       |
| Common name (CN)                                     | The name shown in trust stores                                                                                |
| Organization (O), Country (C), State / Province (ST) | Required. Country is a two-letter code                                                                        |
| Organizational unit (OU), Locality (L)               | Optional                                                                                                      |
| Key algorithm                                        | ECDSA P-256 (recommended), ECDSA P-384, RSA 3072, or RSA 4096                                                 |
| Key protection                                       | Software or HSM. HSM requires supported HSM-capable KMS infrastructure                                       |
| Validity (years)                                     | Defaults to 10. Up to 30                                                                                      |
| Path length (max subordinate CA depth)               | Defaults to 1, allowing issuing CAs but no lower-level CAs                                                    |
| Extended Key Usages (EKU)                            | Select every usage the hierarchy will need. **Client auth** is selected by default. Custom OIDs are supported |

Finish with **Create CA**.

Issuing CAs can only use EKUs selected on the root. Adding an EKU later requires a new root.

A root is created once, signs only issuing CAs, and is the certificate you distribute to devices.

To keep an existing trust hierarchy with Google Cloud KMS, use **Import your own CA**. See [Importing your own CA](/platform/import-ca). Azure Key Vault import is not supported in this release.

## 2. Create the issuing CA

In **Issuing Certificate Authorities**, click **Create issuing CA**.

![The Create an Issuing CA dialog](/assets/docs/quickstart-add-issuing.png)

The issuing CA form differs from the root form:

- a **Parent Root CA** picker, listing your active root;
- **Validity (years)** defaults to 5 rather than 10;
- the EKU checkboxes are limited to the usages the root carries, and there is no custom-OID field.

There is no path-length field. If the button is disabled, hover over it for the reason.

The root stays out of the issuance path — every certificate is signed by an issuing CA.

## 3. Turn on an enrollment endpoint

Open SCEP · ACME · EST and select a protocol.

![The SCEP tab of SCEP · ACME · EST](/assets/docs/quickstart-add-scep.png)

Click **Add endpoint** and enter:

![The Add a SCEP endpoint dialog](/assets/docs/quickstart-add-endpoint.png)

- **Name** — up to 64 characters. Renaming it does not change the URL.
- **Issuing CA** — permanent. Everything else about the endpoint can change.

Finish with **Create endpoint**. For SCEP this also mints the endpoint's registration authority keypair.

A new endpoint starts **Off**. Configure authentication, then turn on **Accepting enrollments**.

| Protocol | Configure                                                                                                                                                                   |
| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SCEP     | Under **Enrollment authentication**: one-time challenges, a shared secret, Microsoft Intune, or Jamf Pro. See [SCEP challenges and secrets](/protocols/scep/authentication) |
| ACME     | Under **External account credentials**: **Mint credential**. See [ACME](/protocols/acme)                                                                                    |
| EST      | Under **Enrollment credentials**: **Mint credential**. See [EST](/protocols/est)                                                                                            |

A SCEP endpoint cannot be turned on until at least one authentication method is configured and on.

Use **Edit** on the **Issuance policy** card to change the endpoint name and policy.

## 4. Distribute trust, then enroll

Devices must trust your root **before** they are pointed at the endpoint.

- **SCEP:** download **CA bundle** beside the endpoint URL.
- **ACME and EST:** open the root on the Certificate Authorities page and select **Download certificate**.

![A SCEP endpoint page: URL, CA bundle, and fingerprints](/assets/docs/quickstart-endpoint-page.png)

Then configure the client with the endpoint URL:

```text
SCEP    https://pki.example.com/scep/<endpoint-id>
ACME    https://pki.example.com/acme/<endpoint-id>/directory
EST     https://pki.example.com/.well-known/est/<endpoint-id>
```

The endpoint ID is the UUID shown on the endpoint page. Renaming an endpoint does not change its URL.

## Test issuance

Before deploying to a fleet, issue one certificate from Certificates. Choose **Server**, **Client**, or **Submit CSR**.

An action is disabled when no active issuing CA permits it; the tooltip names the missing usage, for example _"No active issuing CA allows client certificates (client_auth)"_.

Use it to test issuance and revocation. See [Issuing certificates](/platform/certificates).

## Invite your team

On Users, select **Invite member**. See [Users and roles](/organization/users) and [Two-factor authentication](/organization/two-factor).