Skip to content

Commit 4970f5e

Browse files
csnitker-godaddyclaude
csnitker-godaddy
and
claude
authored
pki: add CA trust bundles for OTE and prod (#19)
* pki: add CA trust bundles for OTE and prod environments Public CA certificates for SDK consumers and service operators to verify TLS connections to ANS endpoints. Two-level hierarchy: root CA with per-region sub-CAs for us-east-1, us-west-2, and ap-south-1 (prod only). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * style: fix markdown lint errors in pki/README.md Wrap long lines to 80 chars, add language tags to fenced code blocks, and add trailing newline. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 324522b commit 4970f5e

File tree

3 files changed

+245
-0
lines changed

3 files changed

+245
-0
lines changed

‎pki/README.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# ANS PKI Trust Material
2+
3+
This directory contains the public CA certificates for the
4+
Agent Name Service (ANS). SDK consumers and service operators
5+
use these bundles to verify TLS connections and certificate
6+
chains when interacting with ANS endpoints.
7+
8+
## Directory Structure
9+
10+
```text
11+
pki/
12+
├── README.md
13+
├── ote/
14+
│ └── ca-bundle.pem
15+
└── prod/
16+
└── ca-bundle.pem
17+
```
18+
19+
## Certificate Hierarchy
20+
21+
ANS uses a two-level CA hierarchy. Each environment has a
22+
single root CA and per-region sub-CAs that issue leaf
23+
certificates directly.
24+
25+
```text
26+
Root CA (self-signed, per-environment)
27+
CN = gd-domain-parking
28+
O = GoDaddy, OU = Engineering, C = US
29+
│
30+
├── Sub-CA (us-east-1)
31+
├── Sub-CA (us-west-2)
32+
└── Sub-CA (ap-south-1) ← prod only
33+
```
34+
35+
## Environments
36+
37+
- **`prod/`** — Production CA chain. Includes the root CA
38+
and per-region sub-CAs.
39+
- **`ote/`** — OTE (test) CA chain. Includes per-region
40+
sub-CAs only. Separate CA hierarchy from prod.
41+
42+
Inspect individual certificates for details (subject,
43+
validity, extensions, etc.) using the commands in the
44+
[Verifying Certificates](#verifying-certificates) section.
45+
46+
## Bundle Format
47+
48+
Each `ca-bundle.pem` contains all CA certificates for its
49+
environment as concatenated PEM blocks. Region comments
50+
(e.g. `# us-east-1`) are included between certificates for
51+
human readability. Certificates are ordered by region; the
52+
root CA (when present) appears first.
53+
54+
## Verifying Certificates
55+
56+
Inspect certificates in a bundle:
57+
58+
```bash
59+
# Fingerprint a single cert
60+
openssl x509 -in cert.pem -noout -fingerprint -sha256
61+
62+
# Split a bundle and fingerprint each cert
63+
csplit -z ca-bundle.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
64+
for f in xx*; do
65+
openssl x509 -in "$f" -noout -subject -fingerprint -sha256
66+
done
67+
rm xx*
68+
```
69+
70+
## Usage
71+
72+
### Go
73+
74+
```go
75+
pool := x509.NewCertPool()
76+
bundle, _ := os.ReadFile("pki/prod/ca-bundle.pem")
77+
pool.AppendCertsFromPEM(bundle)
78+
79+
tlsConfig := &tls.Config{RootCAs: pool}
80+
```
81+
82+
### Rust
83+
84+
```rust
85+
let bundle = std::fs::read("pki/prod/ca-bundle.pem")?;
86+
let certs = rustls_pemfile::certs(&mut &bundle[..])
87+
.collect::<Result<Vec<_>, _>>()?;
88+
89+
let mut root_store = RootCertStore::empty();
90+
for cert in certs {
91+
root_store.add(cert)?;
92+
}
93+
```
94+
95+
### OpenSSL CLI
96+
97+
```bash
98+
# Verify a leaf certificate against the bundle
99+
openssl verify -CAfile pki/prod/ca-bundle.pem leaf.pem
100+
101+
# Inspect a certificate in the bundle
102+
openssl x509 -in pki/prod/ca-bundle.pem -noout -text
103+
```
104+
105+
## Rotation Policy
106+
107+
- Root CAs have a **10-year** validity window (prod) to
108+
minimize rotation overhead.
109+
- Sub-CAs have **5-year** (prod) or **2-year** (OTE)
110+
validity windows.
111+
- New certificates will be committed to this repo **before
112+
expiry** of the outgoing cert, with both old and new
113+
present in the bundle during the transition period.
114+
- Retired certificates will be moved to a `retired/`
115+
subdirectory with a commit message noting the reason
116+
and date.
117+
- Git history is the version record. Do not create versioned
118+
subdirectories.
119+
120+
## Important Notes
121+
122+
- **Do not pin individual certificate serial numbers.**
123+
Regional sub-CAs may be reissued independently. Pin the
124+
root CA fingerprint or load the full bundle.
125+
- **OTE and prod are separate trust domains.** Never load
126+
`ote/` bundles in production configurations. The
127+
environments use completely independent CA hierarchies.
128+
- **Verify bundle integrity after download.** Use the
129+
fingerprint commands in the
130+
[Verifying Certificates](#verifying-certificates) section
131+
to confirm certificates match expected values.

‎pki/ote/ca-bundle.pem‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# us-east-1
2+
-----BEGIN CERTIFICATE-----
3+
MIIDmTCCAoGgAwIBAgIQILhFlUrXwppjoFkNR+k1uDANBgkqhkiG9w0BAQsFADBR
4+
MQswCQYDVQQGEwJVUzEQMA4GA1UECgwHR29EYWRkeTEUMBIGA1UECwwLRW5naW5l
5+
ZXJpbmcxGjAYBgNVBAMMEWdkLWRvbWFpbi1wYXJraW5nMB4XDTI1MTAyMzIyNTE1
6+
OFoXDTI3MTAyMzIzNTE1OFowWDELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0dvRGFk
7+
ZHkxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSEwHwYDVQQDDBhBZ2VudCBOYW1lIFNl
8+
cnZpY2UgU3RhZ2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwq1LX
9+
nHPnMAKaVAWIb4ZHmZfId1B0J4iHmgJF4Wp9GMy55QxNQRb4hEA7NavM0KOQeL1H
10+
kub32s9F/4UMDACAUrZ0yEAH+mAfDhhLoebAvDDuWv7kDtUAaeCZFcYKsw2v5S6H
11+
+/RC5EAogTDvAe1BMn+20xzLFCT0pybv0nTUxiPQCP7r1waN3+V22l43u9oRqgTt
12+
Z9WtPe0l8wxEnT1Cv2F+LqlXnxkOKfmFA1fJDaBbw0SGu8+DX+qRqLAo3zIY6RYk
13+
wSOwioC0f6sBPlX+aNEW5Lx7ii6lAW/jqVGZmpLTKAGMvWgr/46AjUBt5+uswiYd
14+
92gwZRvaAym8Uyj1AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0j
15+
BBgwFoAUJeWbgI+B0jtA4lQ1vm3W2h9XQX8wHQYDVR0OBBYEFKdjaAsN3joDSR3J
16+
NMH2FyibfkIeMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEADzrA
17+
EBmCtJtHRUIzqlcex5N/odstSh+aTjzajg84HRe3FERZeHMpRMwP0jkCDKEg8kF0
18+
0Px4bfztY6ICKye5NinoKiTfQ8gEnuN/UdGUjF0rj95klHYeahLqjWvSagl5bFfT
19+
3x/tKlcCXOKVOZqjNPAlTs/1HxiD34nhZy/nAiRw9zCDYjdsQtOAwppCzdV8t06b
20+
FBHthatRTgmsNEvWBKypvwNRdx/bjUmtWMnro28R0yO9W1NGB6s6GyuJrM6u080Z
21+
VVk2NuCVOfq02SUKjbK8CEtOVt/apCQKOhT8yXbEMzaqOz3M+Lv29/rztgl4ESe/
22+
PWhxLX7bnjbvm0Vq3g==
23+
-----END CERTIFICATE-----
24+
# us-west-2
25+
-----BEGIN CERTIFICATE-----
26+
MIIDmTCCAoGgAwIBAgIQfqwguE1BN7vTpO5FjyloETANBgkqhkiG9w0BAQsFADBR
27+
MQswCQYDVQQGEwJVUzEQMA4GA1UECgwHR29EYWRkeTEUMBIGA1UECwwLRW5naW5l
28+
ZXJpbmcxGjAYBgNVBAMMEWdkLWRvbWFpbi1wYXJraW5nMB4XDTI1MTAyMzIyNDgw
29+
NloXDTI3MTAyMzIzNDgwNVowWDELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0dvRGFk
30+
ZHkxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSEwHwYDVQQDDBhBZ2VudCBOYW1lIFNl
31+
cnZpY2UgU3RhZ2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCM2Tvx
32+
+0X40tp0Ytmxv0e8zjQxNt0iKtaq/U89vRPJwp9jdTKkhmf00VfwrOs0/W4yiUs4
33+
5movCHCchBRr/Mk40DnR/bJ927hrMFjuX6vDDtUqJNSyBWEyMKtWZ1xGz9mP91hC
34+
Z9UG/f5nxGrUxx4P41iq5MbPFQkCQThb8RK1qeWXj90f4UL+wj0emIIE/EOJ1o0Z
35+
3aWqrQ36bvYsOuFDXFfYumMdaQm9NQksi6eqYLrLis1Qw09ZN7cTM71iTTl2su/b
36+
C1JDj/jKUtcmU9chAMJirTRrwNaC30lU/Qsdph6bW2/SDYaVfAa1Y2bt/Soui/e7
37+
wMQzE8mhCgXklwi3AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0j
38+
BBgwFoAUJeWbgI+B0jtA4lQ1vm3W2h9XQX8wHQYDVR0OBBYEFHNwl4zCinyJXm3G
39+
Hi10PPgYk+diMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEARndW
40+
uebdLgi2CPvpLjgHuIAQyyntpXV5DkN89U0/SMPJptqKlNeSOUsuzkt2bWSltklY
41+
oFpSIKVpyo4H9tAfZNmyAIzNblFInOOHvdZm7sSxLyqoDm99PU7VUWxLU+0YZUrK
42+
epmE74P3pr2tbnhzMxqNc8A9TkK2K1NJTd5stW5MwRqUA3b1agLTOwfp0Bz/msO0
43+
EubK1xWZkYYQ4gmds+o1QSaJnf0DB5U50OD/q/VJo9b5KsDPk4eh7+LbLoRBJRIb
44+
z5lXsuUm8h7Xkmr4GOynMwDS+p5wpq3iVqDy4ZtlpLQmBv4DwyF3xniGTfV7ISEI
45+
+O9ggUsQuil2VaP+LA==
46+
-----END CERTIFICATE-----

‎pki/prod/ca-bundle.pem‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# ap-south-1
2+
-----BEGIN CERTIFICATE-----
3+
MIIDbzCCAlegAwIBAgIRAMGqojYhC9BsrBd/XDXfeMkwDQYJKoZIhvcNAQELBQAw
4+
UTELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0dvRGFkZHkxFDASBgNVBAsMC0VuZ2lu
5+
ZWVyaW5nMRowGAYDVQQDDBFnZC1kb21haW4tcGFya2luZzAeFw0yNTEwMTUxNzU0
6+
MjlaFw0zNTEwMTUxODU0MjlaMFExCzAJBgNVBAYTAlVTMRAwDgYDVQQKDAdHb0Rh
7+
ZGR5MRQwEgYDVQQLDAtFbmdpbmVlcmluZzEaMBgGA1UEAwwRZ2QtZG9tYWluLXBh
8+
cmtpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRBNu8fAf2luhs
9+
xCvviklDt2Nx/Mmr2TrtnCV50B9X+e1vR3W6DMab7+TzoBldpBypmr8BG4mH2L5F
10+
a4bcmpwkuRXdP0N7CoYMJpVQyNM9DBvABbUgkF4y1QEROID2w39djajxgzyfRCTC
11+
Mm88dSL+NlvfCHxsN/pXkJnnErrVWovxpHVWdQglYQ/NBKfhRWBaC0PBR8yd4zkQ
12+
DY6UA10a2vb8InBSI73AafgLCt/iCRCpI7sbOgERBTgU6RDnAauZpjnnoSplzKnz
13+
7JtdD0z8AMZi6RTKsIaRBs293zPlWCnf0eCzAufURtFP2YcEuMlEjnoi1zIsyArh
14+
vb55f2NNAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMkZc+Pg
15+
Kn3Efi1noFxrRX+L9/CRMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
16+
AQEAKMVSsBsuQHX1Y0a8vX8uuQzZ5Fjx4OMq6YBvTaxLiro24lGntbyZvs88Kiar
17+
ZINQ/ZltU1an6dJbCd7/2rNV2bUR5CBOzNixQyLmCKcWBzQRoV5AVEfovr4wAUiG
18+
SORzbe9lx9PFM9WllXTiHG0AFHCP+FgOAPUGGtNlFbORa60HWQVXt4pCUNrnWFpF
19+
pHuCk5DZY0V7YWB4yR8uuKtxwJj+lk29BvavBy0f9hQWa7+Ssg1J9KCk4Dtsm2w8
20+
jf1/HsQpXKDV2M4Ab+SK5eZSnEWXOsqzzmEuKXYJasVA9HTW7IsRXTwpiay2o01Z
21+
dLqYgYorJPvg4VtVmlcambgOhw==
22+
-----END CERTIFICATE-----
23+
# us-east-1
24+
-----BEGIN CERTIFICATE-----
25+
MIIDlDCCAnygAwIBAgIRAPbJUP3ge3RALcAa5k4gr3gwDQYJKoZIhvcNAQELBQAw
26+
UTELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0dvRGFkZHkxFDASBgNVBAsMC0VuZ2lu
27+
ZWVyaW5nMRowGAYDVQQDDBFnZC1kb21haW4tcGFya2luZzAeFw0yNTEwMTUyMTU1
28+
MzdaFw0zMDEwMTUyMjU1MzZaMFIxCzAJBgNVBAYTAlVTMRAwDgYDVQQKDAdHb0Rh
29+
ZGR5MRQwEgYDVQQLDAtFbmdpbmVlcmluZzEbMBkGA1UEAwwSQWdlbnQgTmFtZSBT
30+
ZXJ2aWNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwyEkbV7s0Zvn
31+
UviixuNhIPtb7vKgOUknHDnnzhF4OxH7nfX3FL2PRAMniA0+dhZMramv3vVUAJ/Q
32+
a8YB/cujBlrOk+qnXpPN2batf7Ta/MQv2m0sADyuJuH/LUJp1OMyUu8fixtJdsgp
33+
SGkzJBZQhNQ4aL7+dx3k7WZUd2xSLgJmclJJzfylxqfEqeG7iJyUU5MinIxqK07f
34+
sh7gBfa3ovzEztH4ywMtAKuzimXFNSqpDY/MBz8NoTF8jTbfwzJtYx9Vbu38lBca
35+
E0EUxktpYo3cQ5x0IZ3cm6JQhxcYUmoNOf6ygu57L53nRyoy81W28mZL4jX+UkL+
36+
KhEa+aByOQIDAQABo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB8GA1UdIwQYMBaA
37+
FMkZc+PgKn3Efi1noFxrRX+L9/CRMB0GA1UdDgQWBBTfmY0o/EdYa8NIFosw7ND9
38+
H/wshzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBACc1HokhSI0E
39+
XPmK8+TPOHqISOhDlVQ/bKgHS6HCrFkkR5knJ/VVLfV9bEgYM/fRT9cJQIvOS0MS
40+
KYIcK4zzlQRsHsp51MQNOCWruE9fi5IPFDal9OlE+ql9MwO0Qx6d+Trh+Tz3CUN7
41+
xFKbb7uXIOLEPyA8TuIlcfQwsgPXwL82PJ6G5Sn2H8E1Qoz+qGGc3oEKC9qVDMxl
42+
fFYSiZs8AlHVZc9ksdpCc8Bh6vHQb3lhmi6A7wQyIDU+4lT6GVnGBlwyzHli6gRr
43+
1EuDiedc7Us+FZ3GnBt8fwbWrm4vS1gMZxDh1vQYkVdnzd9qhe/drtv3oa0BgMse
44+
6kRq3rWFyX0=
45+
-----END CERTIFICATE-----
46+
# us-west-2
47+
-----BEGIN CERTIFICATE-----
48+
MIIDlDCCAnygAwIBAgIRAO450Z0iRiXGOI9KNaXfvlYwDQYJKoZIhvcNAQELBQAw
49+
UTELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0dvRGFkZHkxFDASBgNVBAsMC0VuZ2lu
50+
ZWVyaW5nMRowGAYDVQQDDBFnZC1kb21haW4tcGFya2luZzAeFw0yNTEwMTYxNjIy
51+
NTNaFw0zMDEwMTYxNzIyNTJaMFIxCzAJBgNVBAYTAlVTMRAwDgYDVQQKDAdHb0Rh
52+
ZGR5MRQwEgYDVQQLDAtFbmdpbmVlcmluZzEbMBkGA1UEAwwSQWdlbnQgTmFtZSBT
53+
ZXJ2aWNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn/0HbiHoUgvo
54+
61Vl0EUBPKMuKOuOZuVYEHaDSaxIsdmeBwA1tVKvtQxc6UcfOvSpeOqSYvsIJiXF
55+
GLHuSJqVNa+0riVz6YOXfjfT7KhszvROFjD7N95PBkeb+CMC59KIk5+Z/tsYrS3n
56+
YzPcy5GwhG5KoktY5zbtr6Rjs9oC8BQ99DUROhFdts96s57ATKU6AqUDk/qESaNT
57+
Yg8NpNNa8vZQ6N2X9DdIMe4xtOIIeTEtLTGsF5grLhLSQrbCMd+VkxEQ7olvJbh5
58+
p0a6/7q9PoiMI4ZIgSq56ZXYHhYafkqsl5NRIqx1UQmjO2zraVtvXVzYyUw7LIa6
59+
HTSu+RNt1wIDAQABo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB8GA1UdIwQYMBaA
60+
FMkZc+PgKn3Efi1noFxrRX+L9/CRMB0GA1UdDgQWBBR5GnSju2ofXceYeogOocUo
61+
FXrjfjAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBAFUju2SY9QwG
62+
HDv/phIqMkil0LWgIlMsJQb1pyISvaroPd4/j6o9ts+FWdbevSehBCyPS1Crf5Iw
63+
4DzD5VQ5q8u4uJoTw1wbikojBW60V8lw8oQQHocsegX87rNoxPuurcSRJSDkMDD5
64+
YE8uWhmb67tAhXoaVOS8HmdU3+9oH2kPKxI7qV5RP/YOIrrnMsG1e2sSW+85eaTe
65+
E1X2HZ2mZFFLSy6dAi/zUdBhe/875kuDvGkYmfRh341u2f6lO/ixmF1EGK3sWg5y
66+
p/KlSd37D9gM2m/cSVHJYVpSuYrdXKaRhfPIOfnW1S4MSQMvT4FQbiIsnzfJ8vBZ
67+
tOneSTftmRU=
68+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)