X.509 authority support lives in the authority-x509 feature and currently requires the ecc platform.
Build example:
./gradlew shadowJar -Pkeeper.features=authority-x509 -Pkeeper.platforms=ecc
An X.509 authority lets TKeeper parse a DER-encoded TBS certificate, expose certificate fields to policy, and sign only approved certificate requests.
Use X.509 authorities for:
- internal CA operations
- workload identity certificates
- service or agent certificates
- certificate issuance requiring four-eye approval
Enforcement boundary
TKeeper signs the DER-encoded TBS certificate after policy evaluation. It does not replace the rest of the CA:
- requester authentication and enrollment authorization
- proof-of-possession checks
- serial-number allocation
- final certificate assembly and publication
- certificate transparency, revocation, renewal, or inventory
The CA pipeline must submit and publish the same certificate content that policy approved. Relying parties must still validate the completed certificate chain and constraints.
See Authorities for authority documents and policy format.