Certificates & PKI

The node has a built-in certificate store and PKI, managed in the Certificates tab or under /api/v1/certificates.

Store

• Keystores — a TLS identity (certificate + private key) a listener or outbound connection uses.
• Truststores — CA bundles used to validate the peer.

Every certificate can be inspected (subject, issuer, SAN, validity, fingerprint). Listeners and remote servers reference a keystore / truststore by name to enable TLS / mTLS.

Local CA

Generate a certificate authority and issue partner / server certificates from it:

# generate a CA
curl -s -H "X-API-Key: $KEY" -H 'Content-Type: application/json' \
  "$A/api/v1/certificates/ca" -X POST \
  -d '{"commonName":"PeSIT Wizard CA","organization":"Acme","validityDays":3650}'

# issue and store a server certificate
curl -s -H "X-API-Key: $KEY" -H 'Content-Type: application/json' \
  "$A/api/v1/certificates/issue" -X POST \
  -d '{"name":"pesit-node","commonName":"pesit.example.com","sans":["pesit.example.com"],"ttlDays":825,"kind":"server"}'

Native HashiCorp Vault PKI

Instead of the local CA, the node can issue and sign through Vault's PKI secrets engine (token or AppRole auth), configured per node under /api/v1/certificates/vault.

Rotation, revocation, OCSP

• Rotation — POST /api/v1/certificates/keystores/{name}/rotate re-issues a managed keystore in place; a leader-driven task auto-rotates keystores within PESIT_CERT_ROTATION_DAYS of expiry.

• Revocation — POST /api/v1/certificates/revoked revokes a serial; GET /api/v1/certificates/crl returns a CRL signed by the local CA.

• OCSP — an online responder (RFC 6960) at /ocsp (POST and GET, unauthenticated) answers the revocation status of certificates issued by the local CA, signed by the CA key. Point a certificate's Authority Information Access OCSP URL at it:

  $ openssl ocsp -issuer ca.pem -cert leaf.pem -url http://node:8080/ocsp -CAfile ca.pem
  Response verify OK
  leaf.pem: good