Certificate Lifecycle Service  ·  View 02 of 21  ·  Context and scope

High-Level Architecture

Six stages every certificate passes through, and the one place the loop actually closes.

Editable source SVG draw.io All views
Request and policy Order manager API + queue Policy engine who may ask for what Prove entitlement Domain control DNS-01 · HTTP-01 Workload attestation IRSA · instance identity Issue Public issuance ACME to public CA Private issuance AWS Private CA Distribute and install Delivery adapters SDS · agent · ACM Trust bundles signed, versioned Verify serving Endpoint prober reads the handshake Discovery scan · CT monitor Renew or revoke Renewal scheduler at 1/3 life left Revocation CRL · OCSP Certificate Lifecycle Service — High-Level Architecture Application we own Security / platform Interface / broker event / async The loop closes at 'verify serving', not at 'issue'. An issued certificate nothing is observed presenting is not a renewal that happened. v 1.0 · owner Security Platform Architecture · date 2026-09

The shape

  • Request and policy decide whether an identity may ask at all; entitlement is proved differently per trust domain; issuance is the only stage that can cause a signature.
  • Distribution and installation is a stage, not a side effect: a certificate that reaches a secret store has not yet reached the process that serves it.
  • Verification is a stage of its own, run by components that do not share a failure domain with issuance.

Why the loop closes at verify

  • The renewal scheduler reads what is due from observed state, not from issuance records, so a renewal that did not take effect stays due.
  • This is the difference between a platform that reports green while an endpoint expires, and one that cannot.

Deliberately omitted

  • The discovery feed back into the order manager, which is drawn in view 09 and specified in §8 of the requirement.
◀  System Context All views Actors and Their Core Journeys  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records02-high-level-architecture