Security model¶

This page summarizes how cmp-issuer enforces security goals. Detailed analysis lives in the Threat model.

Goals¶

Goal	Mechanism
Protect credentials	Namespace-bounded Secret RBAC, no secret values in logs or Events
Protect workload keys	P10CR never reads workload keys. KUR authenticates the cert-manager ownership chain before reading the exact current and staged Secrets
Reject forged CMP responses	Pinned PKIProtection mechanism, configured sender identity, transaction ID and nonce checks
Reject substituted certificates	CSR public-key match and CMP trust chain validation
Limit blast radius	Bounded timeouts, response size, poll counts and transaction duration
Fail closed on ambiguity	No partial TLS Secret on verification failure
Survive a restart without re-enrolling	Record the transaction and configuration identity before the first send and the validated chain before it is returned in a `CMPTransaction`. Validate the recorded chain against the current CMP trust anchors again before it is reused

Trust boundaries¶

flowchart TB
  subgraph k8s [Kubernetes]
    RBAC[RBAC]
    CR[CertificateRequest]
    ISS[CMPIssuer]
    SEC[Credential and workload Secrets]
    CERT[Certificate ownership state]
  end
  subgraph cmp [CMP]
    MSG[Protected CMP messages]
    CA[CMP server]
  end
  RBAC --> SEC
  ISS --> SEC
  CERT -->|authorizes KUR key reads| SEC
  CR -->|approved CSR only| MSG
  MSG --> CA

Kubernetes RBAC gates configuration and credential access.
cert-manager approval gates whether any CMP message is sent.
CMP PKIProtection authenticates every request and response regardless of HTTP or HTTPS.
HTTPS adds transport confidentiality when configured.

cmp-issuer vs cert-manager responsibilities¶

Responsibility	Owner
Workload private key generation and storage	cert-manager
CSR creation and signature	cert-manager
KUR Secret selection and key proof validation	cmp-issuer after cert-manager ownership checks
CMP enrollment and validation	cmp-issuer
TLS Secret for the workload	cert-manager after cmp-issuer returns the chain

Residual risks¶

The CMP library and adapter share a maintainer. See ADR 0001 for independent validation requirements.
CMP interoperability depends on server configuration.
A CMPTransaction records the transaction identifier, nonces, issuer identity, credential and KUR workload Secret versions plus the issued chain. It holds no key material, credential values or protected message, so it cannot be used to enroll. A record is resumed only with the bindings the controller wrote and its recorded chain and signer are validated against the current CMP trust anchors before use. Grant read access to cmptransactions as narrowly as you grant it to certificaterequests and write access to the controller only.
Transaction persistence gaps leave specific ambiguous failure modes open. See Known limitations.

Supply chain¶

Release artifacts, vulnerability scanning and credential scanning are described in Provenance and supply chain.