SPIRE is the reference implementation of the SPIFFE standard. A SPIRE Server includes its own issuing CA, which issues short-lived SPIFFE Verifiable Identity Documents (SVIDs) to workloads and AI agents.
You can anchor the SPIRE trust domain in a CSP Certificate Authority.
- When SPIRE rotates its intermediate CA, the plugin submits the CSR to the CA Gateway endpoint of the CSP Certificate Authority.
- SPIRE continues to handle workload attestation and SVID issuance, while trust remains rooted in the CSP Certificate Authority. This enables mTLS-based agent-to-agent and agent-to-service authentication without static secrets or API keys.
To integrate Certificate Authority with SPIRE, you need:
- A deployed Certificate Authority to sign the SPIRE intermediate CA. See Configuring and deploying Certificate Authority for details on deploying a Certificate Authority instance.
- A certificate profile suitable for issuing subordinate CA certificates. See Managing certificate profiles for details on browsing and updating the available profiles.
- A CA Gateway client credential (PKCS#12) for mutual TLS authentication. See Creating CA Gateway API credentials for details on obtain these credentials.
For build, installation, configuration, supported SPIRE versions and limitations, see the following GitHub repository.
https://github.com/EntrustCorporation/cagw-spire-upstreamauthority-plugin