CA Certificate Management

BitDrip intercepts HTTPS traffic by acting as a trusted local CA. Each supported enrolled workstation generates its own CA keypair, and the supported workflow is designed to keep the private key in the device keystore. Admins can monitor reported CA status, trigger rotation, and review recorded lifecycle events from the Admin Dashboard.

How it works

When the tray app installs on a workstation, it runs bitdrip cert generate to create an EC P-256 CA keypair. The private key is stored in the OS keystore (macOS Keychain, Windows DPAPI, Linux libsecret) — never written to disk in plaintext. The public certificate is installed into the OS and browser trust stores so the proxy can intercept HTTPS without browser warnings.

Each CA certificate is valid for 2 years. Leaf certificates issued per-request are valid for 24 hours.

Viewing CA status per workstation

In the Admin Dashboard, navigate to Workstations → CA Management. The page shows enrolled workstations that have reported through the supported management path, with:

Column	Meaning
Status	Online / Offline (based on last heartbeat)
CA installed	Whether the CA cert is in the OS trust store
Expires	CA certificate expiry date
Last event	Most recent lifecycle event (generated, rotated, etc.)

Workstations with a CA expiring within 30 days are highlighted. The tray app also shows a yellow warning icon and changes its tooltip to "BitDrip — CA certificate expiring soon".

Triggering rotation

To rotate a workstation's CA:

1. Go to Workstations → CA Management
2. Click Rotate CA on the target workstation
3. The dashboard sets a rotationRequested flag on the workstation record
4. On the workstation's next heartbeat (within 60 seconds), the policy engine returns rotationRequested: true in the response
5. The tray app detects this, runs bitdrip cert generate --rotate, installs the new CA, and records the event

The old CA is revoked from the trust store and replaced atomically. Active connections are not interrupted — they complete under the old CA and new connections use the new one.

WARNING

Rotation requires the workstation to be online and the tray app to be running. If the workstation is offline, the rotation flag persists and will apply at next contact.

CA lifecycle events

Supported CA lifecycle events received by the policy engine are recorded in the audit log with the configured integrity controls. Events visible in CA Management → Audit Log include:

Event	Triggered by	Meaning
generated	Workstation	New CA keypair created
installed	Workstation	CA cert added to OS trust stores
rotated	Workstation	CA replaced following admin rotation request
revoked	Workstation	CA removed from trust stores
expired_warning	Workstation	CA within 30 days of expiry
expiry_alert	Workstation	CA within 7 days of expiry

Events are written by the proxy daemon directly to the policy engine over the workstation's authenticated API key channel. Admins cannot write or delete events.

CLI commands

These are the underlying commands the tray app uses — useful for scripting or troubleshooting:

# Show current CA status (fingerprint, expiry, trust store state)
bitdrip cert status

# Generate a new CA (first install)
bitdrip cert generate

# Rotate the CA (generates new keypair, installs, revokes old)
bitdrip cert generate --rotate

# Install existing CA into OS and browser trust stores
bitdrip cert install

Security properties

• Local key custody by design — the supported application path sends certificate status fields, not the CA private key, to the policy engine and is designed to retain the key in the workstation keystore. Endpoint privileges, backups, diagnostics, keystore configuration, and customer operations can affect actual custody and must be validated.
• Runtime scope is not a certificate constraint — the runtime allowlist and proxy policy limit normal BitDrip interception to configured supported destinations, but the CA has no documented X.509 hostname constraint. Compromise of its trusted private key could enable arbitrary-host certificates. Endpoint and key protection are therefore critical; incident response must rotate the key and verify removal of the old CA from all physical trust stores, user stores, browsers, files, and backups.
• 2-year maximum TTL — per NIST SP 800-57; organisations can configure a shorter minimum via org CA policy
• 24-hour leaf TTL — per-request certificates expire quickly, minimising exposure if extracted from memory
• RFC 5280 serial numbers — 20 random bytes, guaranteed non-negative and non-zero

Troubleshooting

"CA not installed" shown in dashboard despite tray running Run bitdrip cert status on the workstation. If the CA is generated but not installed, run bitdrip cert install. This typically happens if the tray app was installed without admin privileges.

Rotation requested but not applied after several minutes The workstation may be offline or the tray app may have crashed. Check the tray icon — if it is grey, restart the tray app. The rotation flag persists and will apply automatically when the app reconnects.

CA expired — proxy refusing connections Run bitdrip cert generate --rotate on the workstation. This generates a fresh CA, installs it, and resumes normal operation. If the tray app is unresponsive, run the command directly in a terminal.