> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/troubleshooting/root-certificate-issued-non-ca-leaves.md).

# Root Certificate Issued Non-CA Leaves

This health check ensures a proper Certificate Authority (CA) hierarchy is followed by verifying that leaf certificates are not issued directly by a root CA. Ideally, a root CA should only sign an intermediate CA, and leaf certificates should be issued by intermediates.

#### Health Check Name: `root_issued_leaves`

#### Accessed APIs

| Method | Endpoint                  | Description                                              |
| ------ | ------------------------- | -------------------------------------------------------- |
| LIST   | `/issuers`                | Lists all configured issuers                             |
| READ   | `/issuer/:issuer_ref/pem` | Retrieves PEM-encoded certificate for a specific issuer  |
| LIST   | `/certs`                  | Lists issued certificates                                |
| READ   | `/certs/:serial`          | Reads details of a specific certificate by serial number |

#### Configuration Parameters

| Parameter        | Type | Default | Description                                                                 |
| ---------------- | ---- | ------- | --------------------------------------------------------------------------- |
| `certs_to_fetch` | int  | `100`   | Number of leaf certificates to inspect for root-signed non-CA leaf issuance |

#### Health Check Results

| Condition                                             | Status      | Description                                          |
| ----------------------------------------------------- | ----------- | ---------------------------------------------------- |
| No non-CA leaf certificates signed by a root found    | **OK**      | Indicates a correct CA hierarchy is in use           |
| One or more non-CA leaf certificates signed by a root | **Warning** | Root CAs should not directly issue leaf certificates |

#### **Recommended Actions** 

* Restrict usage of the following APIs on the root CA: `sign`, `sign-verbatim`, `issue`, and ACME.
* Create an intermediate issuer in a separate mount.
* Have the root CA sign the intermediate issuer.
* Issue all future leaf certificates using the intermediate issuer.
* Reissue existing leaf certificates that were directly signed by the root using the intermediate CA.