liveBook · Manning

Istio certificate authority

As explained in Google Anthos in Action

The Istio certificate authority is the Istio component that issues workload identities through signed certificates.

Istio’s certificate authority (CA) manages certificate issuance for mesh workloads, helping services establish trusted identities and defend against man-in-the-middle and unknown-service communication. section 4.3.3

A CA acts as a trusted third party by issuing digital certificates that bind public keys to named subjects. Istio uses this mechanism to provision strong identities to every workload and support a zero-trust posture. section 4.3.3

Istio supports several certificate-signing arrangements:

  • Generate a self-signed root certificate and key by default, then use them to sign microservice certificates. section 4.3.3
  • Use an administrator-specified certificate and key for signing. section 4.3.3
  • Use an existing root certificate or delegated CA signing certificate and key, a common enterprise arrangement. section 4.3.3

How Google Anthos in Action covers it

How deep it goes
Defines certificate authority roles and configuration choices but stops short of deployment procedures or certificate lifecycle operations.
Examples
Contrasts self-signed roots, administrator-specified signing credentials, and existing enterprise root or delegated CA credentials.
What you can do after
Operate Istio certificate issuance using default, administrator-specified, or enterprise delegated signing credentials.
How it connects
Connects workload identity to digital certificates, root certificates, delegated CAs, peer authentication, authorization, and zero-trust security.
Cover of Google Anthos in Action
liveBookmanning.com
Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.