CA Certificate Management

BitDrip intercepts HTTPS traffic by acting as a trusted local CA. Every workstation generates its own CA keypair — the private key never leaves the device. Admins can monitor CA status, trigger rotation, and review the full lifecycle audit log from the Admin Dashboard.

How it works

When the tray app installs on a workstation, it runs bitdrip cert generate to create an EC P-256 CA keypair. The private key is stored in the OS keystore (macOS Keychain, Windows DPAPI, Linux libsecret) — never written to disk in plaintext. The public certificate is installed into the OS and browser trust stores so the proxy can intercept HTTPS without browser warnings.

Each CA certificate is valid for 2 years. Leaf certificates issued per-request are valid for 24 hours.

Viewing CA status per workstation

In the Admin Dashboard, navigate to Workstations → CA Management. The page shows every enrolled workstation with:

Column	Meaning
Status	Online / Offline (based on last heartbeat)
CA installed	Whether the CA cert is in the OS trust store
Expires	CA certificate expiry date
Last event	Most recent lifecycle event (generated, rotated, etc.)

Workstations with a CA expiring within 30 days are highlighted. The tray app also shows a yellow warning icon and changes its tooltip to "BitDrip — CA certificate expiring soon".

Triggering rotation

To rotate a workstation's CA:

1. Go to Workstations → CA Management
2. Click Rotate CA on the target workstation
3. The dashboard sets a rotationRequested flag on the workstation record
4. On the workstation's next heartbeat (within 60 seconds), the policy engine returns rotationRequested: true in the response
5. The tray app detects this, runs bitdrip cert generate --rotate, installs the new CA, and records the event

The old CA is revoked from the trust store and replaced atomically. Active connections are not interrupted — they complete under the old CA and new connections use the new one.

WARNING

Rotation requires the workstation to be online and the tray app to be running. If the workstation is offline, the rotation flag persists and will apply at next contact.

CA lifecycle events

Every CA action is recorded in an immutable audit log. Events visible in CA Management → Audit Log:

Event	Triggered by	Meaning
generated	Workstation	New CA keypair created
installed	Workstation	CA cert added to OS trust stores
rotated	Workstation	CA replaced following admin rotation request
revoked	Workstation	CA removed from trust stores
expired_warning	Workstation	CA within 30 days of expiry
expiry_alert	Workstation	CA within 7 days of expiry

Events are written by the proxy daemon directly to the policy engine over the workstation's authenticated API key channel. Admins cannot write or delete events.

CLI commands

These are the underlying commands the tray app uses — useful for scripting or troubleshooting:

# Show current CA status (fingerprint, expiry, trust store state)
bitdrip cert status

# Generate a new CA (first install)
bitdrip cert generate

# Rotate the CA (generates new keypair, installs, revokes old)
bitdrip cert generate --rotate

# Install existing CA into OS and browser trust stores
bitdrip cert install

Security properties

• Key never transmitted — only the certificate fingerprint and expiry date are sent to the policy engine; the private key is architecturally confined to the workstation keystore
• Name constraints — the CA certificate includes an X.509 Name Constraints critical extension limiting it to AI service domains only; a compromised CA cannot be used to MITM banking or email
• 2-year maximum TTL — per NIST SP 800-57; organisations can configure a shorter minimum via org CA policy
• 24-hour leaf TTL — per-request certificates expire quickly, minimising exposure if extracted from memory
• RFC 5280 serial numbers — 20 random bytes, guaranteed non-negative and non-zero

Troubleshooting

"CA not installed" shown in dashboard despite tray running Run bitdrip cert status on the workstation. If the CA is generated but not installed, run bitdrip cert install. This typically happens if the tray app was installed without admin privileges.

Rotation requested but not applied after several minutes The workstation may be offline or the tray app may have crashed. Check the tray icon — if it is grey, restart the tray app. The rotation flag persists and will apply automatically when the app reconnects.

CA expired — proxy refusing connections Run bitdrip cert generate --rotate on the workstation. This generates a fresh CA, installs it, and resumes normal operation. If the tray app is unresponsive, run the command directly in a terminal.