Certificate Lifecycle Service · View 17 of 21 · Operations
The gate
- Issuance from a new authority is blocked until every relying party has reported the trust bundle version containing it. The gate is mechanical, not procedural.
- A relying party that cannot report its bundle version blocks the rotation by name. That is a deliberate forcing function: an unreportable consumer is an architectural gap, not an inconvenience.
Draining, not cutting over
- The outgoing intermediate stays trusted while it stops issuing, and retires when its longest-lived leaf expires naturally — bounded by leaf lifetime, which is 24 hours for workloads.
- A canary identity is issued and probed under the new authority before anything else is, so the first real leaf is not the experiment.
Assumptions
- Trust bundle distribution to 100% of reporting relying parties: ≤ 4 hours p95.
- Policy is a reviewed pull request with two-person approval; constraint checks (EKU, name constraints, path length) run before merge, not at issuance time.
