Certificates are issued only to identities that have been authorised by manufactAI GmbH PKI operations. Three enrollment paths are offered; all produce the private key on the requester's system. We never generate or see private keys.
ACME recommended
Fully automated issuance and renewal for hosts you control. Any RFC 8555 client works (certbot, acme.sh, Caddy, Traefik, cert-manager, step). Issuance is restricted to the name spaces listed below; requests for other names are refused by the CA.
| Directory URL | https://ca.manufactai.com/acme/acme/directory |
|---|---|
| Reachable from | Our internal networks only. The certificate authority does not answer from the public internet. If you need access, contact pki@manufactai.com and we will arrange it. |
| Challenges | http-01, tls-alpn-01, dns-01 |
| Validity | 30 days by default, 90 days maximum; renew at 2/3 of lifetime |
| Authorised names | Namespaces under manufactai.com, agreed per subscriber. The namespace for your systems is named in your onboarding. |
| Anything else | Refused by the CA. A wildcard covers exactly one level, so api.manufactai.com is included while a name one level deeper needs its own entry. Tell us the names you need and we add them. |
# certbot certbot certonly --standalone --server https://ca.manufactai.com/acme/acme/directory -d api.manufactai.com # Caddy (Caddyfile): no manual steps, renews automatically api.manufactai.com { tls { ca https://ca.manufactai.com/acme/acme/directory } reverse_proxy localhost:8080 } # step CLI step ca certificate api.manufactai.com api.crt api.key --provisioner acme
One-time enrollment token
For systems that cannot answer ACME challenges (batch jobs, appliances, client certificates for mTLS). PKI operations issue a signed single-use token bound to the exact subject and SANs; it expires after 30 minutes.
# run on the target system; the key never leaves it step ca bootstrap --ca-url https://ca.manufactai.com --fingerprint c452995632b267e6462ad68fd94f1fe931ffbf2c3fa8255382102df3d0436da7 step ca certificate client.manufactai.com client.crt client.key --token "$TOKEN" # keep it renewed; no further token needed step ca renew --daemon client.crt client.key # client certificates: renewal over mTLS step ca renew --daemon --mtls=false server.crt server.key # server certificates: serverAuth only, so renewal uses an X5C token
Kubernetes via cert-manager
Point a ClusterIssuer at our ACME directory; cert-manager handles issuance and renewal for Ingress resources and workload certificates.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: manufactai-acme }
spec:
acme:
server: https://ca.manufactai.com/acme/acme/directory
caBundle: <base64 of manufactai-chain.pem>
privateKeySecretRef: { name: manufactai-acme-account }
solvers: [{ http01: { ingress: { class: traefik } } }]Certificate profiles
Exactly two end-entity profiles exist. Key usages are kept separate on purpose: a server certificate cannot be used to authenticate as a client, and vice versa.
| TLS server | EKU serverAuth · SAN dNSName required · ECDSA P-256 or RSA ≥ 2048 · ≤ 90 days · CDP + AIA present |
|---|---|
| mTLS client | EKU clientAuth · SAN dNSName · ECDSA P-256 · ≤ 90 days · CDP + AIA present |
| Not offered | Code signing, S/MIME, dual-purpose server+client certificates, validity beyond 90 days |