SharkTrust Private CA

Certificate automation for products built to last

SharkCA automates HTTPS certificate enrollment, installation, and renewal for embedded web interfaces on private and air-gapped networks. It helps device manufacturers simplify commissioning and reduce recurring work for service teams throughout a product's operating life.

Industrial controllers, wind turbine systems, and other connected products may remain in service for decades. Automated certificate management helps these products adapt as customers update their browsers and certificate policies.

Apple's TLS validation enforces an 825-day maximum lifetime for server certificates issued by private CAs, including those used by Safari and applications that rely on Apple's trust services. See Apple's certificate requirements. SharkCA's default 90-day device certificates fit comfortably within this limit, with automatic renewal built into the client integration. Browser vendors may change their lifetime limits over time. SharkCA's configurable certificate lifetimes let operators apply updated policies to new certificates through the same automated issuance and renewal process.

• Simplify installation and servicing. Integrated clients obtain and install certificates for new and replacement devices, reducing manual certificate-file handling at each customer site.
• Keep certificate management local. Run the portal on a Windows computer or a dedicated embedded Linux computer. Certificate issuance and renewal can operate entirely within an isolated network.
• Give customers control over trust. Use a local private CA or an intermediate signed by the customer's CA, with certificate administration and device records managed through one portal.

Explore the user manual or follow the setup steps below to bring automated certificate management into your product.

How SharkCA works

SharkTrust Private CA (SharkCA) gives devices on private networks HTTPS certificates for names such as controller.local, local IPv4 addresses, or both. Mako and Xedge clients enroll and renew automatically through the Automatic Certificate Management Environment (ACME) protocol.

Each enrollment zone has its own certificate authority (CA), credentials and device policy. A site administrator manages the portal and can delegate zones to zone administrators. Devices on separate WAN network groups can use the same .local name. SharkCA does not provide DNS services; named devices use multicast DNS (mDNS) on their local network.

Private certificates need trust installed on the computers that use them. The portal itself can use Let's Encrypt for browser-trusted HTTPS, but device certificates are always signed by the zone's private CA.

Start the portal

Use a current Mako Server executable and matching mako.zip, with the TPM certificate-signing APIs described under runtime requirements.

Create a private mako.conf in this repository's root directory:

-- Load the portal at / from the source directory beside this configuration.
apps={{name="",path="www"}}

apps is Mako's application list. The string name="" selects the site root; the string path="www" selects the portal directory. No priority setting is needed.

Run mako from that directory and open https://localhost/. Create the site administrator account and choose local or WAN network grouping. Use one zone for a local installation; setup creates it automatically. For WAN, create each zone with a distinct portal domain, such as zone1.example.com and zone2.example.com, with all domains pointing to the same VPS. See zones and network groups. The initial HTTPS certificate may cause a browser warning until you configure the portal address and trust its certificate. Follow the HTTPS setup guide.

For a remote installation, create the account on the first run:

# Replace both values. The password must contain 12-128 bytes.
mako -credentials "my-admin-name:REPLACE_WITH_A_STRONG_PASSWORD"

This protects setup before remote visitors can reach it. Sign in at the portal's HTTPS address, then restart without the credentials argument. See headless installation for details. Do not also pass -l::www when apps already loads the portal.

Connect devices

Create a zone in Zones, then use Credentials or Download C code to configure its devices. Import the zone's root certificate on computers and applications that will connect to those devices.

Mako devices use the acme.sharkca client settings. These belong in the device's mako.conf. The portal's optional sharkca table instead controls CA policy and notifications. See portal configuration for those settings. The Xedge UI exposes Use SharkCA when its BAS host provides mDNS support; see Connect Xedge.

Administration and maintenance

Use Certificate authority to renew a root, rotate its key, or import an externally signed intermediate. Signing uses the Barracuda App Server (BAS) Trusted Platform Module (TPM) interface; Mako's software TPM is not a hardware TPM chip. However, backups must be restored on the same hardware.

Device certificates default to 90 days. You can choose a shorter lifetime in mako.conf, such as six days. Short lifetimes limit how long an issued certificate remains valid; they do not revoke it. If a CA is compromised, remove its trust and delete the affected zone.

Guide	Use it for
User manual	Zones, administrator accounts, device setup and CA maintenance.
Operations reference	Configuration, email, Microsoft sign-in, password recovery and backups.
Installation checks	Verify browser trust, device enrollment and restart behavior.