| ID | product.platform.secrets_manager.ca_service |
|---|---|
| Description | Issues device X.509 certificates. |
| Key | ca_service |
| Type | component |
| Team | Platform Engineering |
| Owner | platform@iotgateway.example |
| Status | active |
| Technologies | Go, PKI/x509, HashiCorp Vault |
| Attributes | cert_ttl: 90d, key_algorithm: ECDSA P-256 |
| Tags |
Table of contents
Guide
CA Service
The CA Service is the certificate authority behind every device identity. Given a certificate signing request, it validates the requester, signs a short-lived X.509 certificate, and records it for later revocation.
Why short-lived certs
A device certificate is valid for 90d. Short lifetimes mean a lost or cloned key stops working soon on its own — rotation, not revocation, is the primary defence.