PKI ceremony
Purpose
Section titled “Purpose”Establish trust anchors for Edge device mTLS (Devices CA) and signed RAUC update bundles (Updates CA).
Source document
Section titled “Source document”Full ceremony steps: pki-ceremony.md at monorepo root.
Summary
Section titled “Summary”| CA | Use | Distribution |
|---|---|---|
| Root CA | Offline trust anchor | Cold storage; never in runtime env |
| Devices CA | Edge client certificates at claim-complete | Key Vault → Backend/Ingestor; chain to devices |
| Updates CA | RAUC bundle signing | ADO secret variable group only |
Dev fixtures
Section titled “Dev fixtures”Backend/testdata/pki/ — OpenSSL-generated, test-only. Do not use in production.
Related
Section titled “Related”- Edge registration — optional mTLS at claim-complete
- Security overview