https://deevnet.github.io/deevnet-docs/docs/roadmap/infrastructure/substrate/tls-cert-automation/Recent content in TLS Cert Automation on Deevnet IoTaaSHugoen-ushttps://deevnet.github.io/deevnet-docs/docs/roadmap/infrastructure/substrate/tls-cert-automation/plan/Mon, 01 Jan 0001 00:00:00 +0000https://deevnet.github.io/deevnet-docs/docs/roadmap/infrastructure/substrate/tls-cert-automation/plan/<h1 id="tls-cert-automation-project-plan"> TLS Cert Automation: Project Plan <a class="anchor" href="#tls-cert-automation-project-plan">#</a> </h1> <p>Every certificate the site serves chains to the <strong>Deevnet Root CA</strong>, kept offline with the Mobile Site CA ( <a href="https://deevnet.github.io/deevnet-docs/deevnet-docs/docs/architecture/decisions/substrate/0031-deevnet-pki/">ADR-0031</a>, <a href="https://deevnet.github.io/deevnet-docs/deevnet-docs/docs/changes/2026/0033-deevnet-pki/">CHG-0033</a>). The Mobile Substrate CA signs every substrate certificate on the control node, OpenBao&rsquo;s listener included, and <code>certs.yml</code> renews them. The Builder, the hypervisors and every management-plane VM trust the root at the OS level; tenants trust it as <code>deevnet-root-ca.pem</code>. Proxmox, the core router and the Omada controller serve site certificates, and every client verifies them ( <a href="https://deevnet.github.io/deevnet-docs/deevnet-docs/docs/runbook/substrate/certificates/">Certificates</a>). The Tenant Device CA is in OpenBao, waiting for device enrollment.</p>