KRGLV / PKI

Certificate Authority

The root certificate for accessing internal KRGLV services, and certificate revocation lists.

Install the Root CA

KRGLV Root CA v3 · valid until December 24, 2035.

Install this root certificate to trust KRGLV services. You do not need to add the intermediate Web CA or User CA to your trusted root certificates.

Download Root CA · .crt

PEM format, public certificate only. Install it on devices that need to trust KRGLV infrastructure. Before installing, verify the fingerprint against a trusted source.

SHA-256 · Certificate fingerprint
2C:EC:CA:EB:85:A0:63:35:2D:BF:1E:02:64:0B:37:21:45:B0:17:5A:4F:27:08:91:CB:77:7C:22:8A:89:2A:97

Installation instructions

macOS
  1. Download the Root CA and open Keychain Access.
  2. Import the certificate into the System keychain. Administrator approval is required.
  3. Open KRGLV Root CA v3, expand Trust, and select Always Trust for Secure Sockets Layer (SSL). Save your changes.

Apple's certificate import guide

Windows
  1. Download the Root CA, open the file, and select Install Certificate.
  2. Select Local Machine if all users need to trust the certificate, and approve the administrator prompt.
  3. Choose the certificate store manually: Trusted Root Certification Authorities. Complete the import.

Microsoft documentation

iOS / iPadOS
  1. Open this page in Safari, download the Root CA, and allow the certificate profile to download.
  2. Open Settings → Profile Downloaded. If this option is missing, go to General → VPN & Device Management.
  3. Select the KRGLV Root CA v3 profile, verify the certificate, and tap Install. Enter your device passcode to confirm.
  4. Enable trust separately: General → About → Certificate Trust Settings → enable full trust for KRGLV Root CA v3.

Installing the profile alone does not enable HTTPS trust: the final step is required.

Apple's guide to trusting root certificates

Android
  1. Download the Root CA to your Downloads folder.
  2. In Settings, open Security & privacy → More security settings → Encryption & credentials. Names vary by manufacturer and Android version; you can also search Settings for “Install a certificate”.
  3. Select Install a certificate → CA certificate. HTTPS trust requires a CA certificate, not a Wi-Fi or VPN certificate.
  4. Read the CA trust warning, confirm with your device PIN or password, and select the downloaded krglv-root-ca-v3.crt file.

Some apps do not trust user-installed CAs or use certificate pinning. Installing the root does not change those apps' trust policies.

Google's certificate management guide

Ubuntu / Debian

Download the file, open a terminal in the download directory, and run:

sudo install -m 0644 krglv-root-ca-v3.crt /usr/local/share/ca-certificates/krglv-root-ca-v3.crt
sudo update-ca-certificates

These commands add the root to the system trust store. Apps with their own trust stores may need separate configuration.

Certificate revocation lists

CRLs are used to check whether certificates have been revoked. Do not install them as trusted root certificates.

Web CA · CRLService certificatesUser CA · CRLUser certificates