Lifecycle
How ArmorIQ monitors certificate expiry, auto-renews or rotates certificates, and revokes them through Google CAS.
Expiry monitoring
A daily job checks every active certificate at 06:00 UTC and flags any certificate expiring within 30 days. The job crosses four thresholds: 30, 14, 7, and 1 day(s) remaining, and records an expiry event the first time a certificate passes each one, so operators see escalating warnings as an expiry date approaches rather than a single alert.
Auto-renewal
Each certificate has an auto-rotation flag. When a certificate crosses an expiry threshold and auto-rotation is enabled for it, the backend automatically rotates that certificate (revoking the old one and issuing a replacement) without operator action. If auto-rotation is off, the expiry job only logs a warning; nothing is rotated automatically.
Auto-rotation is set when a certificate is created. The dashboard's Certificates table shows the current Auto state as On or Off, but does not yet expose a control to change it from the UI: set it through the underlying update endpoint if you need to change it for an existing certificate.
Manual rotation
Rotating a certificate revokes the current certificate and issues a new one for the same domain and subject fields, keeping certificate history linked through a previousCertId reference. From the dashboard, rotate a single certificate with Rotate now, or rotate every currently-expiring certificate in one action with the bulk Rotate expiring control.
Only certificates issued through ArmorIQ's own certificate service can be rotated through Google CAS. Certificate metadata sourced from an MCP server or agent record's own configuration is shown in the same table for visibility, but rotating it does not call CAS: you need to re-issue that server or agent's certificate directly instead.
Revocation
Revoking a certificate calls Google CAS to revoke the underlying CA-issued certificate, then marks the certificate revoked in ArmorIQ regardless of whether CAS accepts the revocation. A handful of CAS error conditions (the certificate isn't found in the CA pool, or the request is otherwise not fulfillable at the CA) are treated as a local-only revocation rather than a hard failure, since the certificate is no longer usable in ArmorIQ either way. Any other CAS error is surfaced rather than silently ignored.
Status values
A certificate's status is one of:
| Status | Meaning |
|---|---|
active | Currently valid and trusted |
expired | Past its validity window |
revoked | Explicitly revoked, through the dashboard or automatically during rotation |
Encryption details
See Certificates for how private keys are encrypted at rest with Cloud KMS and the CERT_KMS_KEY_NAME configuration it depends on.