Certificates
Issue, monitor, rotate, and revoke the TLS certificates that establish trusted identity for MCP servers and agents.
ArmorIQ issues and tracks X.509 certificates that establish trusted TLS identity for the MCP servers and agents in your registry. Certificates back the connections the proxy verifies before it will route a tool call, and the dashboard surfaces their status, expiry, and rotation history alongside the resource they belong to.
What a certificate provides
A certificate binds a domain name and common name to a key pair and an issuer chain. ArmorIQ uses this to confirm that an MCP server or agent endpoint is who it claims to be before the proxy trusts traffic to it. Certificates are organization-scoped and can be attached to an MCP server or an agent record.
The Certificates screen aggregates three sources into one view: certificates issued through ArmorIQ's own certificate service, plus certificate metadata already stored on MCP server and agent records. Only the first kind can be rotated through Google Certificate Authority Service: see Lifecycle for the distinction.
Issuance
New certificates are issued against Google Certificate Authority Service (CAS). ArmorIQ generates an RSA-2048 key pair and a certificate signing request, then calls CAS using the CA pool configured for the organization's identity provider (project, location, and pool ID) to obtain a signed certificate with a one-year lifetime. If an active, unexpired certificate already exists for the same domain, issuance reuses it instead of creating a duplicate.
Encryption at rest
The issued private key is encrypted with Google Cloud KMS before it is stored, using a KMS key resource configured through the CERT_KMS_KEY_NAME environment variable. If that variable is not set, the backend logs a warning and stores the private key in plaintext instead. Operators running their own instance should set CERT_KMS_KEY_NAME to keep private keys encrypted at rest.
CERT_KMS_KEY_NAME is not included in the shipping .env.example. Set it explicitly in your deployment configuration; otherwise certificate private keys are persisted unencrypted.
The Certificates screen
Open a server or agent's Certificates view from the MCP dashboard to see every certificate in the organization in one table.
Each row shows:
| Column | Description |
|---|---|
| MCP / fingerprint | The owning resource plus the certificate's fingerprint and serial number |
| Issuer | Issuing CA and issue date |
| Profile | Certificate profile badge |
| Days | Days remaining until expiry, color-coded as it approaches the deadline |
| Status | valid, expiring, or expired |
| Auto | Whether auto-rotation is on or off for that certificate |
A 12-month expiry timeline highlights the 30-day danger window, and a stat strip summarizes active, expiring, expired, auto-rotate, and BYO certificate counts along with average certificate lifetime.
Actions
- Rotate now: available on any certificate that is not
valid, and as a bulk Rotate expiring action that rotates every expiring certificate in one click. - Download cert and Export (CSV/JSON): client-side export of certificate metadata.
- Import BYO cert: present in the UI but disabled today; the dashboard shows "Requires backend support" because there is no bring-your-own-certificate import endpoint yet.
The Auto column is display-only in the current dashboard. The backend does expose a toggle for auto-rotation (see Lifecycle), but the UI does not yet call it, so today auto-rotation is set at issuance time rather than toggled from this screen.