Certificate Lifecycle Management
The core API runs a full certificate authority (root + intermediate CA) that issues, rotates, and revokes client and server certificates automatically.
- Root CA / Intermediate CA issuance chain for headend and client identities.
- Certificates are generated automatically on client registration, and clients fetch renewed certificates before expiration.
- An admin can revoke a client certificate immediately, cutting off headend access.
- Client-side CLI commands (cert-info, renew-cert) surface certificate status without a portal round trip.