Obtaining a certificate

ACME recommended

Fully automated issuance and renewal for hosts you control. Any RFC 8555 client works (certbot, acme.sh, Caddy, Traefik, cert-manager, step). Issuance is restricted to the name spaces listed below; requests for other names are refused by the CA.

# certbot
certbot certonly --standalone --server https://ca.manufactai.com/acme/acme/directory -d api.example.com

# Caddy (Caddyfile) – zero-touch, renews automatically
api.example.com {
    tls { ca https://ca.manufactai.com/acme/acme/directory }
    reverse_proxy localhost:8080
}

# step CLI
step ca certificate api.example.com api.crt api.key --provisioner acme

One-time enrollment token

For systems that cannot answer ACME challenges (batch jobs, appliances, client certificates for mTLS). PKI operations issue a signed single-use token bound to the exact subject and SANs; it expires after 30 minutes.

# on the target system – the key never leaves it
step ca bootstrap --ca-url https://ca.manufactai.com --fingerprint ebe211b90d660f57cc351f1f9d8db0c3eecd23c9cb624cfe02fcfcf9ea3c0a86
step ca certificate client.example.com client.crt client.key --token "$TOKEN"

# keep it renewed; no further token needed
step ca renew --daemon client.crt client.key                # client certificates: renewal over mTLS
step ca renew --daemon --mtls=false server.crt server.key   # server certificates: serverAuth only, so renewal uses an X5C token

Kubernetes via cert-manager

Point a ClusterIssuer at our ACME directory; cert-manager handles issuance and renewal for Ingress resources and workload certificates.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: manufactai-acme }
spec:
  acme:
    server: https://ca.manufactai.com/acme/acme/directory
    caBundle: <base64 of manufactai-chain.pem>
    privateKeySecretRef: { name: manufactai-acme-account }
    solvers: [{ http01: { ingress: { class: traefik } } }]

Certificate profiles

Exactly two end-entity profiles exist. Key usages are kept separate on purpose: a server certificate cannot be used to authenticate as a client, and vice versa.