The Certificate Manager subsystem provides the capability of a Certificate Authority (CA). It can issue, renew, revoke, and publish certificates, as well as compile and publish CRLs. Since the Certificate Manager acts as a CA, it can be configured as a self-signing CA, where it is the root CA, or it can act as a subordinate CA, where it obtains its signing certificate from another CA.