Skip to main content
logoTetrate Istio SubscriptionVersion: Next

TIS Integration with External CA Overview

Introduction​

One critical aspect of deploying service meshes in enterprise environments is the integration with external Certificate Authorities (CAs). This integration ensures that the security policies and compliance requirements of the organization are consistently enforced across all services.

Overview of External CA Integration​

Integrating TIS with an external CA allows enterprises to leverage their existing Public Key Infrastructure (PKI) for issuing and managing certificates within the service mesh. This seamless integration enhances security by unifying certificate management and simplifies compliance reporting.

Key Features​

  • Custom CA Support: TIS enables the use of custom CAs for issuing mutual TLS (mTLS) certificates, allowing organizations to maintain control over their cryptographic materials.
  • Automated Certificate Management: With TIS, certificate issuance and rotation can be automated, reducing the operational overhead associated with manual certificate management.
  • Compliance and Security: Leveraging an external CA helps in meeting regulatory requirements by ensuring that all certificates adhere to the organization's security policies.

Integration Process​

Integrating TIS with an external CA involves configuring the Istio control plane to communicate with the organization's CA infrastructure. Below is a high-level overview of the steps involved:

  1. Prepare the External CA: Ensure that the external CA is accessible and configured to issue certificates compatible with Istio's requirements.
  2. Set Up Trust Anchors: Update the trust anchors in the service mesh to include the external CA.
  3. Install TIS: The standard installation of TIS is sufficient, and no special adjustments are necessary.
  4. Test the Integration: Deploy test workloads to verify that mTLS connections are established using certificates issued by the external CA.
  5. Monitor and Maintain: Use TIS tools and dashboards to monitor certificate status and set up alerts for certificate expiration or revocation.