Kioubit Trusted Certificate Authority

Signed by the main DN42 CA
Supported Features
  • ✓ Wildcard certificates
  • ✓ Multi-SAN certificates
  • ✓ IP address certificates
  • ✓ Anycasted services
Download CA PEM
Automated Usage
Generate and sign certificates via the command line.
1 Download the client.sh script
2
Get a re-usable token verifying your DN42 identity:
3 Save the token as token.txt in the script folder
4

Run the generation command:

./client.sh get_certificate <domain.dn42>
5 Configure signed.crt and server.key in your webserver
Prefer a GUI?

Get a certificate entirely within your browser. No local scripts required.

Online Certificate System

* Note: Renewals must be performed manually.

Authorization Rules

When you request a certificate for one or more domains and/or IP addresses, your request is validated against the following rules:

1. Quantity Limit

The combined number of domains and IP addresses must not exceed 40.

2. Domain Resolution & Name Server Check
  • Regular domains are first resolved to their IP address(es). If DNS resolution fails, the system falls back to checking the authoritative name server's glue records for that domain.
  • Wildcard domains (e.g. *.example.dn42) are always resolved via their authoritative name server's glue records (no standard DNS resolution is attempted).
3. Route / Origin Authorization

For every IP address derived from the steps above (whether from direct IP input, domain resolution, or name server glue), the system checks:

  • It looks up the longest-prefix-matching route object (IPv4 or IPv6) from the registry.
  • The matching route object must list your ASN as an authorized origin.

If at least one of the IP addresses associated with a given domain or IP input is covered by a route object that lists your ASN, that domain/IP is considered authorized.