Root of Trust #

Every certificate Deevnet issues chains to one root, the Deevnet Root CA, and each site has its own Site CA under it ( Trust and Identity, ADR-0031). The Deevnet Root CA and Site CA private keys are generated and maintained offline and are never available to site automation or networked systems.

New to certificates? The Cryptography and PKI Primer explains keys, signatures, chains and CAs from the beginning.

These pages are the key holder’s procedures. They run on an offline machine, rarely:

What crosses to automation #

Only certificates and signing requests cross between the offline machine and automation:

• certificates: the root’s, each Site CA’s, and each signed issuing CA’s;
• certificate signing requests, which come in from automation to be signed.

They cross on the transfer media, the only thing that moves between the online and offline machines. The Root CA’s and Site CAs’ keys stay on their own key media, which is only ever plugged into the offline machine. A key never leaves the offline machine except as an encrypted file onto that key media.

An issuing CA’s key is generated where it will live (site automation for the Substrate CA, the secret store for the Tenant Device CA and the Tenant Service CA), and only its request is brought to the ceremony. Two small tools in ansible-collection-deevnet.mgmt/scripts/pki/ move it and its certificate across, with a manifest of hashes each way, a refusal of any private key on the transfer media, and checks of the request, the signature and the chain ( Issuing CA). They automate the mechanics and the checking. Signing stays a decision the key holder makes by typing the CA’s name.

Certificate names #

Every certificate names its organization, its unit and itself, so its Issued To and Issued By read plainly ( Certificates standard):