The CA Service is the certificate authority behind every device identity. Given a certificate signing request, it validates the requester, signs a short-lived X.509 certificate, and records it for later revocation.
Why short-lived certs
A device certificate is valid for 90d. Short lifetimes mean a lost or cloned key stops working soon on its own — rotation, not revocation, is the primary defence.
A validated CSR is signed with the issuing key fetched from the Secret Store and returned with its chain.
Before expiry the device requests a fresh certificate; the old one is allowed to lapse rather than being revoked.
A compromised serial is added to the CRL, served from GET /ca/crl, so relying
parties reject it immediately.
Certificate issuance is the trust step of device provisioning:
Keys are ECDSA P-256 — small, fast to verify on constrained devices, and supported by the MQTT broker’s mutual-TLS handshake.