# Request and issue a certificate > Create an enrollment request, get it approved, and issue the first certificate with the private key source that fits your server. Section: PKI & CLM Source: https://www.itva.com/docs/pki-clm/request-and-issue-a-certificate Last updated: 2026-11-03 To get a new certificate from ITVA, you first request an enrollment. A user who can manage change requests approves the request, and ITVA creates the enrollment. You then issue the certificate from the enrollment. By the end of this guide, you will have an issued certificate in your inventory. ## Before you begin - Add an issuer. See [Add a Windows ADCS issuer](https://www.itva.com/docs/issuers/add-a-windows-adcs-issuer) or [Add a DigiCert issuer](https://www.itva.com/docs/issuers/add-a-digicert-issuer). - Make sure that the issuer has at least one enabled CA template. See [Set up certificate templates](https://www.itva.com/docs/pki-clm/set-up-certificate-templates). - To create or approve a request, your role needs the **Manage** permission for **Change Requests**. - To issue the certificate, your role needs the **Manage** permission for **Enrollments**. - To generate the key on a server, add the server to ITVA as a device first. To generate an ML-DSA key on a server, the server must run Linux with OpenSSL 3.5 or later. ## Create an enrollment request 1. In the Tools menu, open **Certificate Change Request**. 2. Select **New**. The **New Certificate Enrollment Request** drawer opens. 3. In **Name**, type a name for the request. 4. Select the template. ITVA fills in the organization fields and the extended key usages from the template. 5. Check the extended key usages. Change them if the certificate needs different usages. 6. In **Common Name**, type the main name of the certificate, for example `www.example.com`. 7. Check **Organization**, **Organization Unit**, **City**, **State / Province**, and **Country**. All of these fields are required. 8. Under **Subject Alt Names**, select **Add DNS:** to add the common name as a DNS name. 9. To add another name, select **Add Subject Alternative Name**. Select a **Kind** (DNS or IP), then type the **Value**. 10. Select **Save**. ITVA opens the request. Its status is Pending until a user approves or rejects it. A request needs at least one subject alternative name. The template sets how the CA uses your extended key usages. A standalone CA issues the usages that the request asks for. An enterprise CA applies its own template, so it usually issues the usages from that template instead. ITVA keeps one enrollment for each issuer and common name. If an enrollment with the same issuer and common name already exists, the approved request updates that enrollment. It does not create a second one. ## Approve the request Any user with the **Manage** permission for **Change Requests** can approve the request. 1. In the Tools menu, open **Certificate Change Request**. 2. Open the request. Its **Kind** is Enrollment. 3. Check the details. If something is wrong, select **Edit** and correct it. 4. Select **Approve**. To refuse the request, select **Reject**. After approval, ITVA creates the enrollment in the background. The requester becomes the **Owner** of the enrollment. The request moves through these statuses: | Status | Meaning | | --- | --- | | Pending | The request waits for approval. You can edit, approve, or reject it. | | Rejected | A user rejected the request. ITVA makes no change. | | Queued | The request is approved and waits to run. | | Applying | ITVA is making the change. | | Succeeded | ITVA made the change. | | Failed | ITVA could not make the change. The request shows the error, and you can select Retry. | ## Issue the certificate 1. In the PKI menu, open **Enrollments**. 2. Open the enrollment. 3. Select **Issue**. 4. Select where the private key comes from. The next section explains each option. 5. Fill in the fields for that option. 6. Select **Issue**. ITVA sends the request to the CA and waits for the certificate. If the enrollment has installs with **Auto Install** on, the drawer lists them, and ITVA installs the new certificate on each one. ### Private key sources | Option | Fields | ITVA stores the key | Auto renew | | --- | --- | --- | --- | | ITVA Generated Private Key | Private Key Algorithm | Yes | Yes, with a new key each time | | Provide a CSR | Certificate Signing Request | No | No | | Generate on Device | Device, Private Key Path, Private Key Algorithm | No, the key stays on the device | Yes, with a new key at the same path | | Provide a Private Key | Private Key, Password | Yes | Yes, with the same key | - **ITVA Generated Private Key**: ITVA makes the key and the CSR. Select the **Private Key Algorithm**. - **Provide a CSR**: paste a PEM CSR that starts with `-----BEGIN CERTIFICATE REQUEST-----`. ITVA never has the private key. You must paste a new CSR each time you renew or reissue. - **Generate on Device**: select a server in **Device**. In **Private Key Path**, type the path on the device where ITVA saves the key, for example `/etc/ssl/private/www.example.com.key`. Then select the **Private Key Algorithm**. - **Provide a Private Key**: paste a PEM private key in **Private Key**. If the key is encrypted, type its **Password**. ITVA makes the CSR from the key. ITVA supports RSA 2048, RSA 3072, RSA 4096, RSA 8192, ECDSA 256, ECDSA 384, ECDSA 521, ML-DSA-44, ML-DSA-65, and ML-DSA-87. The template can allow only some of them, and the list shows only the allowed algorithms. ITVA also checks the key in a pasted CSR or private key against the template. ## Issue several certificates at once A bulk issue uses an ITVA generated private key for each enrollment. To use another key source, issue each enrollment separately. 1. In the PKI menu, open **Enrollments**. 2. Select the enrollments to issue. 3. In the menu that shows your selection, select **Issue**. The **Issue Certificates** drawer opens. 4. Select the **Private Key Algorithm**. 5. Select **Issue**. ITVA skips enrollments that already have a certificate, and the drawer tells you how many it skips. The list shows only the algorithms that the templates of all selected enrollments allow. If one enrollment fails, ITVA still issues the others and shows an error for each failure. ## Check that it worked 1. Open the enrollment request on the **Certificate Change Request** page. Make sure that its status is Succeeded. 2. Open the enrollment. Make sure that the **Versions** card shows the new certificate with its issue and expiry dates. 3. Open the certificate from the **Versions** card. Make sure that its status is Valid. ## Troubleshooting ### There is no New, Approve, or Issue button ITVA hides these buttons if your role does not have the permission. **New** and **Approve** need **Manage** for **Change Requests**. **Issue** needs **Manage** for **Enrollments**. Ask an administrator to add the permission to your role. ### The template is not in the list The template is not enabled. A user who can manage CA templates must turn on **Enabled** for it. See [Set up certificate templates](https://www.itva.com/docs/pki-clm/set-up-certificate-templates). ### "... is not allowed by the ... template" The key algorithm of the pasted CSR or private key is not allowed by the template. The message lists the allowed algorithms. Make a new key with an allowed algorithm, or select **ITVA Generated Private Key**. ### The request status is Failed Open the request and read the error. Fix the cause, for example the issuer connection, then select **Retry**. ### "The selected enrollments do not share an allowed private key algorithm" The templates of the selected enrollments have no algorithm in common. Select fewer enrollments, or issue them separately. ### The issue fails with an error from the CA ITVA shows the error that the issuer returned. Check the issuer connection and the template settings, then select **Issue** again.