x/cert — Certificates module
The x/cert module is the protocol’s on-chain public key infrastructure. It
anchors TLS certificates so that providers and tenants can mutually
authenticate off-chain connections, with the ledger as the root of trust
rather than a commercial certificate authority.
Certificates are issued and revoked by their owning accounts, giving every marketplace participant a self-service PKI. Both sides of a connection verify the peer’s certificate against chain state before workload data moves.
What it does
Section titled “What it does”When a tenant’s client connects to a provider daemon endpoint — to send a manifest, fetch logs, or reach a deployed service — both sides verify the peer’s certificate against chain state.
Certificates are issued and revoked by their owning accounts, giving every marketplace participant a self-service PKI whose root of trust is the ledger rather than a commercial certificate authority. Revocation is recorded on-chain, so it takes effect for all future connection checks and is visible to every counterparty.
Why it exists
Section titled “Why it exists”Leases are agreed on-chain but workloads are served off-chain. Without a shared PKI, the off-chain hop would be the weakest link — either unauthenticated or dependent on external CAs. Anchoring certificates in consensus lets any lease counterparty verify exactly who they are talking to.
Primary objects
Section titled “Primary objects”| Concept | Definition |
|---|---|
| mTLS | Mutual TLS — both client and server authenticate, each verified against on-chain certificate state. |
| Revocation | On-chain invalidation of a certificate, effective for all future connection checks. |
Core flow
Section titled “Core flow”- Issue — Accounts issue certificates. Owning accounts create certificates for their endpoints and clients — self-service PKI.
- Present — Peers present on connect. Provider endpoints and tenant clients present chain-anchored certificates when connections open.
- Verify — Both sides check chain state. Mutual verification against on-chain records before any workload data moves.
- Revoke — Revocation is on-chain. Invalidation takes effect for all future connection checks, visible to every counterparty.
Messages
Section titled “Messages”| Message | Purpose |
|---|---|
MsgCreateCertificate | An owning account issues a certificate for its endpoint or client. |
MsgRevokeCertificate | The owning account revokes a certificate on-chain. |
Queries
Section titled “Queries”| Query | Purpose |
|---|---|
Certificates | Chain-anchored certificates recorded for lookup during connection checks. |
Module interactions
Section titled “Module interactions”| Module | How they interact |
|---|---|
| x/provider | Provider endpoints present chain-anchored certificates to tenants. |
| x/deployment | Tenant clients authenticate with certificates when delivering manifests. |
| x/market | Lease counterparties are the identities certificates authenticate. |
Related documentation
Section titled “Related documentation”- Provider Daemon — the daemon endpoints certificates authenticate.
- Deploying Workloads — tenant clients delivering manifests over verified channels.
- Security — the provider-side security posture around endpoints.
- On-Chain Module Map — all 27 modules at a glance.
Why not just use public certificate authorities?
Section titled “Why not just use public certificate authorities?”Leases are agreed on-chain but workloads are served off-chain. Anchoring certificates in consensus lets any lease counterparty verify exactly who they are talking to, without depending on external authorities for the protocol’s most sensitive hop.
What is mTLS in this context?
Section titled “What is mTLS in this context?”Mutual TLS: both client and server authenticate, each verified against on-chain certificate state — the lease counterparties are the identities the certificates authenticate.
What happens on key compromise?
Section titled “What happens on key compromise?”The owning account revokes the certificate on-chain, and revocation is effective for all future connection checks across the marketplace.