consul/website/content/commands/tls/ca.mdx

---
layout: commands
page_title: 'Commands: TLS CA Create'
sidebar_title: ca
---

# Consul TLS CA Create

Command: `consul tls ca create`

This command create a self signed CA to be used for Consul TLS setup.

## Example

Create CA:

```shell-session
$ consul tls ca create
==> Saved consul-ca.pem
==> Saved consul-ca-key.pem
```

## Usage

Usage: `consul tls ca create [filename-prefix] [options]`

#### TLS CA Create Options

- `-additional-name-constraint=<value>` - Add name constraints for the CA.
  Results in rejecting certificates for other DNS than specified. Can be used
  multiple times. Only used in combination with `-name-constraint`.

- `-days=<int>` - Provide number of days the CA is valid for from now on, defaults to 5 years.

- `-domain=<string>` - Domain of consul cluster. Only used in combination with
  `-name-constraint`. Defaults to `consul`.

- `-name-constraint` - Add name constraints for the CA. Results in rejecting
  certificates for other DNS than specified. If turned on localhost and -domain
  will be added to the allowed DNS. If the UI is going to be served over HTTPS
  its DNS has to be added with `-additional-constraint`. It is not possible to
  add that after the fact! Defaults to false.

- `cluster-id` - ClusterID of the consul cluster, requires `-domain` to be set as well.
   When used this will cause URIs to be set with spiffeid.

- `common-name` - Common Name of CA. Defaults to Consul Agent CA.
Builtin tls helper (#5078) * command: add tls subcommand * website: update docs and guide 2018-12-19 08:22:49 +00:00			`---`
docs: update structure (#8506) - moved and renamed files/folders based on new structure - updated docs navigation based on new structure - moved CLI to top nav (created commands.jsx and commands-navigation.js) - updated and added redirects - updating to be consistent with standalone categories - changing "overview" link in top nav to lead to where intro was moved (docs/intro) - adding redirects for intro content - deleting old intro folders - format all data/navigation files - deleting old commands folder - reverting changes to glossary page - adjust intro navigation for removal of 'vs' paths - add helm page redirect - fix more redirects - add a missing redirect - fix broken anchor links and formatting mistakes - deleted duplicate section, added redirect, changed link - removed duplicate glossary page 2020-09-01 15:14:13 +00:00			`layout: commands`
intro and api navigation converted 2020-04-07 18:55:19 +00:00			`page_title: 'Commands: TLS CA Create'`
remove 'sidebar_current' from frontmatter 2020-04-13 18:40:26 +00:00			`sidebar_title: ca`
Builtin tls helper (#5078) * command: add tls subcommand * website: update docs and guide 2018-12-19 08:22:49 +00:00			`---`

			`# Consul TLS CA Create`

			Command: `consul tls ca create`

			`This command create a self signed CA to be used for Consul TLS setup.`

			`## Example`

			`Create CA:`

update dependencies 2020-05-19 18:32:38 +00:00			```shell-session
Builtin tls helper (#5078) * command: add tls subcommand * website: update docs and guide 2018-12-19 08:22:49 +00:00			`$ consul tls ca create`
			`==> Saved consul-ca.pem`
			`==> Saved consul-ca-key.pem`
			```

			`## Usage`
intro and api navigation converted 2020-04-07 18:55:19 +00:00
Builtin tls helper (#5078) * command: add tls subcommand * website: update docs and guide 2018-12-19 08:22:49 +00:00			Usage: `consul tls ca create [filename-prefix] [options]`

			`#### TLS CA Create Options`

docs: update the 'consul tls' command docs to match the current flags (#7911) 2020-05-18 17:01:14 +00:00			- `-additional-name-constraint=<value>` - Add name constraints for the CA.
			`Results in rejecting certificates for other DNS than specified. Can be used`
			multiple times. Only used in combination with `-name-constraint`.

intro and api navigation converted 2020-04-07 18:55:19 +00:00			- `-days=<int>` - Provide number of days the CA is valid for from now on, defaults to 5 years.
docs: update the 'consul tls' command docs to match the current flags (#7911) 2020-05-18 17:01:14 +00:00
			- `-domain=<string>` - Domain of consul cluster. Only used in combination with
			`-name-constraint`. Defaults to `consul`.

			- `-name-constraint` - Add name constraints for the CA. Results in rejecting
			`certificates for other DNS than specified. If turned on localhost and -domain`
			`will be added to the allowed DNS. If the UI is going to be served over HTTPS`
			its DNS has to be added with `-additional-constraint`. It is not possible to
			`add that after the fact! Defaults to false.`
Add docs section on regenerating expired CA certificates (#9709) * Updated docs on regenerating built in CA * review feedback * Add sentence about expected behavior after update CA endpoint is used. 2021-02-11 21:38:12 +00:00
			- `cluster-id` - ClusterID of the consul cluster, requires `-domain` to be set as well.
			`When used this will cause URIs to be set with spiffeid.`

			- `common-name` - Common Name of CA. Defaults to Consul Agent CA.