Root of Trust on Deevnet IoTaaS

Root and Site CA Ceremony

Mon, 01 Jan 0001 00:00:00 +0000

Root and Site CA Ceremony #

The Deevnet Root CA and each site’s Site CA are made in a ceremony: a rare, deliberate session on an offline machine, a computer with no network, so a key it touches can only leave on the drives you carry away. On the pi-pki image a script, ./deevnet-pki-ceremony.sh, walks the whole session step by step and asks before each step. This page is what you need, how to start, what the script does, and the commands it runs.

Issuing CA

Mon, 01 Jan 0001 00:00:00 +0000

Issuing CA #

A site’s certificates are issued by three issuing CAs under its Site CA, each signed in this ceremony:

Issuing CA	Its key lives in	Issues
Deevnet Mobile Substrate CA	site automation, which signs on the control node	every substrate certificate: hosts, appliances, service VMs and their services, the secret store’s own listener
Deevnet Mobile Tenant Device CA	the secret store, behind the Deevnet API	tenant devices’ client certificates (mTLS)
Deevnet Mobile Tenant Service CA	the secret store, behind the Deevnet API	server certificates for tenants’ own services, for names in a tenant’s own zone

Each is valid for five years. Its key is generated where it lives, and only its signing request comes to the ceremony. The Site CA’s holder never sees an issuing CA’s key, and the issuing CA’s system never sees the Site CA’s.

Custody

Mon, 01 Jan 0001 00:00:00 +0000

Custody #

The Root CA’s and every Site CA’s keys exist only as passphrase-encrypted files on two encrypted key drives, kept apart. Both passphrases, the drives’ and the key files’, are kept offline, under the holder’s own control, and never with the key media.

Two key media #

The keys live on two key media, kept apart:

Primary key media: in the holder’s secure storage.
Backup key media: somewhere else, so one loss (fire, theft, a bag left behind) cannot take both.
The paper record: fingerprints and dates of every certificate the ceremonies made. It is how you recognize the right file, and how anyone checks a certificate they were handed.

Neither key media is ever plugged into a networked machine.