Certificate management

As explained in Google Anthos in Action

Certificate management is the issuance, distribution, renewal, and control of digital certificates for authenticated secure communication.

Certificate management secures service-mesh communication by issuing trusted identities for workloads. In Istio, istiod acts as the certificate authority, provisioning certificates that enable secure mutual TLS between services. section 4.3.3 section 4.3.1

Istio certificate management separates trust and signing responsibilities:

• A root certificate may sign every certificate directly, or delegate signing to a subordinate certificate authority. section 4.3.3
• The CA can use a generated self-signed root, an administrator-specified root and key, or an administrator-specified delegated-CA signing certificate and key. section 4.3.3
• Istiod combines certificate management with service discovery, configuration, routing, and authentication components supporting the Envoy sidecars. section 4.3.1

Enterprise trust integration

An enterprise can configure Istio’s CA with an existing organizational root certificate or a delegated CA signing certificate and key, keeping root-signing responsibility outside the mesh. section 4.3.3

Figure 4.4 Detailed Istio architecture

Use the detailed Istio architecture to locate istiod, sidecar proxies, and the certificate-management path within the service mesh. section 4.3.1

How Google Anthos in Action covers it

How deep it goes

Defines certificate authorities, roots, delegated CAs, and signing options, but stops short of renewal procedures or operational commands.

Examples

Uses self-signed roots, administrator-specified roots, and delegated CA signing certificates and keys as configuration examples.

What it assumes

Assumes familiarity with service meshes, microservices, and secure network communication while defining certificate authority roles.

What you can do after

Configure Istio certificate authority settings for workload identities and secure mutual TLS communication.

How it connects

Connects certificate authorities with workload identity, mutual TLS, service meshes, sidecar proxies, and authentication.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• certificateuses · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• clientconfigures · A client is a person, organization, device, or software component that receives or uses a product, service, resource, or functionality provided by another entity.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.