Certificate Authority

CA repository — certificates, fingerprints, and policy for the CagsCalcLabs PKI.

This certificate authority is intended to make it easier for members of the TI programming community to generate TLS certificates should they need to serve a calculator-targeted service. In these environments, ACME and other domain-based challenges for validation are impractical, so I spun up this CA to close that gap. This infrastructure is NOT intended as a bypass for the appropriate security protocols surrounding domain-level/website and non-calculator-targeted TLS certificate issuance and abuse of my system to that end will result in certificate revocation.

Root CA

Self-signed root certificate. Add this to your trust store to trust all CagsCalcLabs-issued certificates.

SHA-256 Fingerprint

AD:E5:CD:CC:63:66:53:EB:0B:C8:D1:3E:9C:DA:78:F9:69:8B:0F:A3:F0:05:0F:B7:38:45:5F:76:C1:6B:A2:3B

Download Root CA

Production Intermediate

Signs all user-issued certificates. Cross-signed by the root CA.

SHA-256 Fingerprint

CA:C6:BD:E2:B7:95:B5:53:95:B3:85:39:02:09:68:48:5D:92:9E:96:0D:0A:B7:C8:EE:21:0F:81:E8:A1:46:DF

Download Intermediate Download Full Chain

Certificate Revocation List

The CRL is regenerated on every revocation and refreshed daily. Valid for 7 days from last generation.

CRL Distribution Point

https://cagscalclabs.net/ca/crl/prod.crl.pem

View CRL

Certificate Policy

This CA issues certificates for use with TI-84+ CE calculator-facing services. Certificates are issued to authenticated portal users only.

Supported Key Algorithms (in order of preference)

P-256 (prime256v1) — recommended
RSA 2048–4096 bit
P-384 (secp384r1)

Certificate Types

Leaf (end-entity) · Sub-intermediate (pathlen:0)

Available Lifetimes

30 days · 90 days · 1 year · 2 years

Signature Algorithm

ECDSA with SHA-256

Limits per User

5 active leaf certs · 1 active sub-intermediate

Request a Certificate

Certificate signing is available through the portal. You will need an account with 2FA enabled.