Module reference · Identity & security
x/cert — Certificates
TLS certificates for mutual authentication between providers and tenants.
What it does
Inside x/cert
The cert module anchors TLS certificates on-chain so that providers and tenants can mutually authenticate off-chain connections. When a tenant's client connects to a provider daemon endpoint — to send a manifest, fetch logs, or reach a deployed service — both sides verify the peer's certificate against chain state.
Certificates are issued and revoked by their owning accounts, giving every marketplace participant a self-service PKI whose root of trust is the ledger rather than a commercial certificate authority.
Why it exists
The design rationale
Leases are agreed on-chain but workloads are served off-chain. Without a shared PKI, the off-chain hop would be the weakest link — either unauthenticated or dependent on external CAs. Anchoring certificates in consensus lets any lease counterparty verify exactly who they are talking to.
Interactions
How it connects to the rest of the chain
No module stands alone — these are the protocol surfaces this module depends on or serves.
- x/provider
Provider endpoints present chain-anchored certificates to tenants.
- x/deployment
Tenant clients authenticate with certificates when delivering manifests.
- x/market
Lease counterparties are the identities certificates authenticate.
Key concepts
Terms that matter here
- mTLS
- Mutual TLS — both client and server authenticate, each verified against on-chain certificate state.
- Revocation
- On-chain invalidation of a certificate, effective for all future connection checks.
Keep exploring