Capabilities and limitations¶
This page describes Trustpoint 1.0.0, the first stable release. Availability depends on the active security preset, certificate profiles, backend capabilities, and device/domain configuration. See the release notes for installation, compatibility, recovery requirements, and known limitations.
Enrollment and lifecycle interfaces¶
Interface |
Implemented paths |
Limits and operator responsibilities |
|---|---|---|
Enrollment/re-enrollment and CA certificate retrieval with configured authentication. |
Requires TLS and matching device/domain/profile policy. Validate the intended client, trust chain, and upstream-RA scenario. |
|
Configured initialization/certification, revocation, certificate confirmation, and workflow-related polling paths. |
Check the operation and protection algorithms supported by the specific endpoint; upstream CA/RA behavior needs separate validation. |
|
|
No |
|
Trustpoint-specific device enrollment/re-enrollment under |
Distinct from resource administration under |
|
Resource/configuration endpoints under |
Consult the individual action’s authentication and permission requirements. |
|
Operator-driven issuance and delivery of stored credentials in supported export formats. |
Export needs stored, exportable key material. A CSR-only request does not give Trustpoint the device’s private key. |
|
Experimental zero-touch onboarding path. |
Proof of concept; do not describe it as generally validated production onboarding. |
|
GDS Push certificate/trust-list operations and agent workflows. |
GDS Push and agents are separate integrations. Validate real target-server security, credentials, algorithms, and certificate deployment/reconnection. |
CAs, backends, and recovery¶
Area |
Current behavior |
Limits |
|---|---|---|
Imported replacement material or generated managed keys followed by EST/CMP certificate acquisition. |
Rollover applies to locally managed signing CAs. Device trust distribution is a separate provisioning responsibility. The separate remote-CA rollover strategy is not registered/available. |
|
Local CA signing, upstream CA requests, and EST/CMP RA forwarding use different paths. |
Test upstream response validation, trust configuration, and supported operations for the chosen mode; these modes are not interchangeable. |
|
The database stores a wrapped DEK; the independent software KEK comes from the deployment’s secret file. |
Retain the original KEK with database recovery material. Software KEK/DEK rotation is not implemented. |
|
Configured provider/token-backed operations according to reported capabilities. |
Real provider mechanisms vary. SoftHSM is for development/testing; its test success does not certify a hardware HSM. PKCS#11 ML-DSA generation/signing is not implemented. |
|
Supported through the software backend. |
Do not infer HSM support from the software algorithm catalog. Protocol/client tooling must support the chosen algorithm. |
|
PostgreSQL payload plus manifest; original external keys and runtime/HSM state retained separately. |
1.0.0 is the first stable compatibility baseline. A payload digest is not backup-source authentication. |
Workflow availability¶
The workflow engine guide lists the registered triggers, approval behavior, YAML syntax, and worker/inline execution modes. A trigger or strategy mentioned in design source is not available merely because its class or enum exists. SCEP has no built-in workflow enrollment trigger in the current handler. External webhook side effects and retries need an integration-specific idempotency plan; do not assume exactly-once delivery.
Release deployment validation¶
Use the release checklist to record actual results for the exact release version and image. Software Compose restart/recreation tests, standalone SoftHSM envelope tests, supported cross-version update tests, and hardware-HSM interoperability are different checks. Complete interactive setup, custom ports/hostnames/IPv6, original-key restore, and intended real client/server tests before describing a deployment combination as validated. Documentation edits alone do not complete those checks.