Certificate Management

Overview

Polystack Key Manager supports two certificate workflows: storing externally issued certificates from your existing CA, and ordering certificates through a configured CA plugin for automated issuance. Both workflows produce a certificate container that can be consumed by the Load Balancer service for HTTPS termination.

Prerequisites

An active Polystack account with appropriate permissions
Access to the Polystack Dashboard or CLI configured with credentials
API credentials sourced (source openrc.sh)

Store an Existing Certificate

Use this workflow when you have an externally issued certificate (Let’s Encrypt, DigiCert, your enterprise CA, etc.) and want to store it in Key Manager.

Store the certificate secret

Store the X.509 certificate

openstack secret store \
  --name app-tls-cert \
  --secret-type certificate \
  --payload-content-type "application/pkix-cert" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 certificate.pem)"

Store the private key secret

Store the private key

openstack secret store \
  --name app-tls-key \
  --secret-type private \
  --payload-content-type "application/pkcs8" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 private_key.pem)"

Store the CA chain (recommended)

Store CA chain

openstack secret store \
  --name app-ca-chain \
  --secret-type certificate \
  --payload-content-type "application/pkix-cert" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 ca-chain.pem)"

Create a certificate container

Bundle into certificate container

openstack secret container create \
  --name app-tls-bundle \
  --type certificate \
  --secret "certificate=<cert-href>" \
  --secret "private_key=<key-href>" \
  --secret "intermediates=<ca-chain-href>"

Container is ready to reference in Load Balancer HTTPS listener configuration.

Order a Certificate

Certificate orders automate issuance through a Certificate Authority plugin configured by your administrator.

Create an order
List and manage orders

Create a certificate order

openstack secret order create certificate \
  --name app-cert-order \
  --algorithm rsa \
  --bit-length 2048 \
  --subject-dn "CN=app.example.com,O=Example Corp,C=US"

Check order status

openstack secret order show <order-href>

When the order status reaches ACTIVE, retrieve the issued certificate container:

Get the issued certificate container

openstack secret order show <order-href> -c container_ref

Certificate order availability depends on your platform’s CA plugin configuration. Contact your administrator to verify which CA backends are enabled.

openstack secret order list

openstack secret order show <order-href>

openstack secret order delete <order-href>

Certificate Lifecycle Management

Stage	Action	Notes
Issuance	Store or order via CA plugin	Creates certificate + key secrets
Deployment	Create container, reference in Load Balancer	Bundles cert + key + chain
Monitoring	Track expiration date externally	Key Manager sends no alerts
Renewal	Store new certificate, update container	Update Load Balancer reference
Revocation	Delete old secrets after transition	Update all service references first

Set calendar reminders at 60 days, 30 days, and 7 days before certificate expiration. Renew the certificate and update the Load Balancer listener reference at least 14 days before expiry to allow for propagation and testing.

Verify a Certificate

Retrieve certificate and check expiry

openstack secret get <cert-href> --payload | \
  openssl x509 -noout -dates -subject

Verify certificate matches private key

openstack secret get <cert-href> --payload > /tmp/cert.pem
openstack secret get <key-href> --payload > /tmp/key.pem
diff <(openssl x509 -noout -modulus -in /tmp/cert.pem | md5sum) \
     <(openssl rsa -noout -modulus -in /tmp/key.pem | md5sum)

If both md5sum values match, the certificate and private key are a valid pair.

Next Steps

Containers

Bundle certificates into containers for Load Balancer use

ACL

Control which users and services can access certificate secrets

Store Secrets

Store other secret types alongside certificates

Troubleshooting

Resolve certificate container and order issues

Core Services

Other Services

Overview

Store an Existing Certificate

Store the certificate secret

Store the private key secret

Store the CA chain (recommended)

Create a certificate container

Order a Certificate

Certificate Lifecycle Management

Verify a Certificate

Next Steps

Containers

ACL

Store Secrets

Troubleshooting

​Overview

​Store an Existing Certificate

Store the certificate secret

Store the private key secret

Store the CA chain (recommended)

Create a certificate container

​Order a Certificate

​Certificate Lifecycle Management

​Verify a Certificate

​Next Steps

Containers

ACL

Store Secrets

Troubleshooting

Overview

Store an Existing Certificate

Order a Certificate

Certificate Lifecycle Management

Verify a Certificate

Next Steps