Certificate Lifecycle Service  ·  View 08 of 21  ·  Structure

Integration Architecture

Every surface in and out, and the single obligation that is genuinely synchronous.

Editable source SVG draw.io All views
Who asks Tenant console domain onboarding Workload agent and mesh SDS cert-manager Deployment pipeline Certificate Lifecycle Service Certificate Lifecycle Service one registry, two trust domains What it depends on Public CA 2 accounts, ACME CT logs AWS Private CA REST CSR readiness orders · SCT SCT + watch sign Certificate Lifecycle Service — Integration Architecture Application we own External / third party Security / platform synchronous Route 53 is not a dependency here but a platform-owned component — the delegated zone the DNS-01 responder answers in (view 07). Two public CA accounts sit behind one integration, so failover is a configuration change rather than a new surface. The only synchronous obligation on a request path is workload issuance; everything else may queue. v 1.0 · owner Integration Architecture · date 2026-09

The one synchronous path

  • Workload issuance is on a request path: a pod that cannot obtain a leaf at startup does not start. p99 ≤ 250 ms in-region (stated assumption).
  • Everything else may queue. A tenant's domain order, a renewal, a revocation publication and an audit export all tolerate minutes.

Decisions

  • Two public CA accounts sit behind one integration, so failover is a configuration change rather than a new surface to build under pressure.
  • Route 53 appears as a platform component, not a dependency: it is the delegated zone the DNS-01 responder answers in.
  • Relying parties validating revocation talk to CRL and OCSP, which are published independently of this service and held to a higher availability target than issuance.

Assumption

  • Public CA rate limits are tracked per registered domain and per account; approaching a limit queues rather than fails.
◀  Container View All views Data Flow  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records08-integration-surface