Certificate Lifecycle Service · View 06 of 21 · Structure
The ordering argument
- Policy is declared and versioned; the control plane reconciles it and is never the authority for it.
- The trust plane sits above the issuance plane because a new authority must be distributed and confirmed everywhere before a single leaf is signed beneath it — enforced by the rotation gate, not by a runbook.
- Verification sits below distribution and writes to the registry, so observed state is what the renewal scheduler reads back.
Separation that matters
- Key custody is its own layer with exactly one caller: the issuing intermediates. Nothing in the control plane can reach a signing module.
- CRL and OCSP publication sits in the evidence layer, independent of issuance, so an issuance outage cannot prevent a revocation.
Assumption
- Two issuing intermediates are live at all times, which is what makes replacing one a 4-hour operation rather than an estate-wide event.
