Deployment Scenarios¶

This document describes common deployment scenarios for Trustpoint, including network topology, security considerations, and configuration patterns.

Scenario 1: Local CA in Isolated OT Network¶

Use Case: Air-gapped OT network with self-contained PKI, no enterprise CA connection

        graph TB
    subgraph "Isolated OT Network"
        DEV1[PLC] -.EST/CMP.-> TP["Trustpoint / Local CA Mode"]
        DEV2[RTU] -.EST/CMP.-> TP
        DEV3[SCADA] -.EST/CMP.-> TP
        TP --> HSM["Hardware HSM / CA Key Storage"]
        TP --> DB[("PostgreSQL / Certificate DB")]
        ADMIN[Admin Workstation] -->|HTTPS| TP
    end
    

    
    style TP fill:#2196F3,color:#fff
    style HSM fill:#FF5722,color:#fff

Configuration:

CA mode: LOCAL_PKCS11 (production) or AUTOGEN (testing)
Network: Single interface, no internet, optional mDNS
Security: HSM for CA key, certificate-based device auth

Pros: Full control, no external dependencies, air-gap compatible

Cons: Requires HSM deployment, manual trust anchor distribution, no external CRL/OCSP

Scenario 2: RA Connected to Enterprise PKI¶

Use Case: OT devices receive certificates from enterprise CA, centralized PKI management

        graph TB
    subgraph "Enterprise Network"
        ENT_CA["Enterprise CA / EST/CMP Server"]
    end
    
    subgraph "OT Network"
        DEV1[PLC] -.EST.-> TP["Trustpoint / RA Mode"]
        DEV2[RTU] -.CMP.-> TP
        TP -.EST/CMP.-> FW[Firewall]
    end
    
    FW --> ENT_CA
    
    style TP fill:#2196F3,color:#fff
    style ENT_CA fill:#4CAF50,color:#fff
    style FW fill:#FF5722,color:#fff

Configuration:

RA mode: REMOTE_EST_RA or REMOTE_CMP_RA
Network: Firewall between OT and enterprise, outbound HTTPS to CA
Security: TLS client auth to enterprise CA, network segmentation

Firewall Rules:

Outbound: TCP 443 to enterprise CA
Inbound: TCP 443 from device subnets
Deny all other inter-network traffic

Pros: Centralized PKI, enterprise policy compliance, no Trustpoint HSM needed

Cons: Dependency on external CA availability, network connectivity required

Scenario 3: Headless Device-Onboarding Service¶

Use Case: Large-scale automated provisioning via API, no web UI

        graph LR
    subgraph "Device Management Platform"
        DMP[Orchestrator] -->|REST API| TP["Trustpoint / API-only"]
    end
    
    subgraph "Device Fleet"
        DEV1[Device 1] -.EST.-> TP
        DEV2[Device 2] -.EST.-> TP
        DEV3[Device N] -.EST.-> TP
    end
    
    TP --> CA["Enterprise CA / or Local CA"]
    
    style TP fill:#FF9800,color:#fff
    style DMP fill:#2196F3,color:#fff

Configuration:

Headless mode: API-only access, JWT authentication
REST API: Enable rest_pki app, rate limiting
Monitoring: Prometheus /metrics, health check /health/

Pros: Scalable, no manual intervention, rapid deployment

Cons: Requires robust automation, reduced oversight

Scenario 4: Development Deployment¶

Use Case: Local development and testing on single machine

        graph TB
    DEV[Developer Machine] --> DC[Docker Compose]
    
    subgraph "Docker Compose Stack"
        DC --> TP[Trustpoint Container]
        DC --> PG[PostgreSQL Container]
        DC --> WORKER[Trustpoint Worker]
    end
    
    TP --> PG
    WORKER --> PG
    
    style DEV fill:#2196F3,color:#fff
    style DC fill:#4CAF50,color:#fff

Configuration:

Deployment: docker-compose.yml
CA mode: AUTOGEN (testing only)
Database: PostgreSQL in container
TLS: Self-signed certificate
Tools: Django Debug Toolbar, hot reload, HTTP access

Command: docker-compose up

Pros: Fast setup, integrated environment, isolated

Cons: Not production-suitable, no persistent storage, no hardware security

Best Practices¶

Use HSM in production - Protect CA keys with hardware HSM
Implement monitoring - Prometheus metrics, log aggregation, alerting
Automate backups - Daily database backups, offsite storage, regular restore testing
Network segmentation - Isolate OT networks, use firewalls
TLS everywhere - Enforce HTTPS, strong cipher suites, HSTS
Regular updates - Apply security patches, update dependencies
Disaster recovery plan - Document and test recovery procedures
Access control - Least privilege, MFA for admin accounts
Audit logging - Track certificate operations, integrate with SIEM
Performance testing - Load test before production deployment