Lesson 11 of 15 · 45 min

Certificates That Live Sixty Seconds

Build a small workload API that identifies a process by asking the kernel who it is, then hands it a certificate valid for one minute — no password, no bootstrap secret, nothing on disk.

Learning objectives

Explain how a short-lived credential reduces, but does not remove, the need for revocation.
Describe the secret zero problem and how attestation avoids it.
Read a SPIFFE ID and say what an SVID is.
Build a workload API that attests a caller with SO_PEERCRED and issues a sixty-second certificate.

The problem you have been carrying since Lesson 5

Look at the certificate you generated:

zsh — 80×24

openssl x509 -in certs/go.crt -noout -dates

Compared with your Lesson 5 certificate	SVID
File format	Identical. Same X.509, same PEM
Signed by a CA	Yes, same as before
Proves possession by signing the handshake	Yes, same as before
Contains a name	Yes — a URI instead of a common name
Contains a hostname or IP	Not the ones we issue. This is the one real difference
Lifetime	60 seconds instead of 10 years
Stored on disk	No. Held in memory only

Word	Means
Attestation	Working out what a process actually is
Selector	A rule describing a process, such as `unix:uid:1000` or `k8s:sa:orders`
Registration entry	A mapping from selectors to a SPIFFE ID

workload-api/main.goGo

func newCA() (*ca, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	template := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "workload-api-ca"},
		NotBefore:             time.Now().Add(-time.Minute),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		return nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, err
	}
	return &ca{
		key:    key,
		cert:   cert,
		bundle: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})),
	}, nil
}

workload-api/main.goGo

func attest(conn *net.UnixConn) (pid int32, uid uint32, cmdline string, err error) {
	raw, err := conn.SyscallConn()
	if err != nil {
		return 0, 0, "", err
	}

	var creds *syscall.Ucred
	var credErr error
	if err := raw.Control(func(fd uintptr) {
		creds, credErr = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
	}); err != nil {
		return 0, 0, "", err
	}
	if credErr != nil {
		return 0, 0, "", credErr
	}

	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/cmdline", creds.Pid))
	if err != nil {
		return creds.Pid, creds.Uid, "", err
	}
	// /proc stores arguments separated by NUL bytes.
	return creds.Pid, creds.Uid, strings.ReplaceAll(string(data), "\x00", " "), nil
}

workload-api/main.goGo

type entry struct {
	cmdlineContains string
	spiffeID        string
}

// Order matters: the first match wins. The node process's command line can
// contain BOTH "server.ts" and the project folder name, so "server.ts" has to
// be checked first.
var entries = []entry{
	{"server.ts", "spiffe://" + trustDomain + "/service/typescript"},
	{"authserver", "spiffe://" + trustDomain + "/service/auth"},
	{"secure-services", "spiffe://" + trustDomain + "/service/go"},
}

Command	Command line the kernel reports contains
`node server.ts`	`server.ts`
`go run ./authserver`	`authserver`
`go run .`	`secure-services`, the folder name

workload-api/main.goGo

func (c *ca) issue(spiffeID string) (*svid, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	uri, err := url.Parse(spiffeID)
	if err != nil {
		return nil, err
	}
	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		return nil, err
	}

	template := &x509.Certificate{
		SerialNumber: serial,
		NotBefore:    time.Now().Add(-30 * time.Second), // allow for clock skew
		NotAfter:     time.Now().Add(svidTTL),           // 60 seconds
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage: []x509.ExtKeyUsage{
			x509.ExtKeyUsageServerAuth,
			x509.ExtKeyUsageClientAuth,
		},
		URIs:                  []*url.URL{uri}, // <- the identity lives here
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, template, c.cert, &key.PublicKey, c.key)
	if err != nil {
		return nil, err
	}
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
		return nil, err
	}

	return &svid{
		SpiffeID:   spiffeID,
		Cert:       string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})),
		Key:        string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})),
		Bundle:     c.bundle,
		TTLSeconds: int(svidTTL.Seconds()),
	}, nil
}

workload-api/main.goGo

func (c *ca) handle(conn *net.UnixConn) {
	defer conn.Close()

	pid, uid, cmdline, err := attest(conn)
	if err != nil {
		log.Printf("    attestation failed: %v", err)
		return
	}

	for _, e := range entries {
		if !strings.Contains(cmdline, e.cmdlineContains) {
			continue
		}
		s, err := c.issue(e.spiffeID)
		if err != nil {
			log.Printf("    issue failed: %v", err)
			return
		}
		log.Printf("    issued  %-38s pid=%d uid=%d ttl=%s", s.SpiffeID, pid, uid, svidTTL)
		_ = json.NewEncoder(conn).Encode(s)
		return
	}

	log.Printf("    no registration entry matches pid=%d (%s)", pid, strings.TrimSpace(cmdline))
}

workload-api/main.goGo

// A tiny stand-in for the SPIRE agent.
//
// Real SPIRE is a pair of daemons and a gRPC API. This does the same four
// things in a form you can read in one sitting:
//
//  1. It holds the CA. Nothing else has a key on disk.
//  2. It listens on a UNIX SOCKET, not a TCP port.
//  3. When a workload connects, it asks the KERNEL who that process is.
//     The workload does not get to say. This is called ATTESTATION.
//  4. It issues a certificate that lives 60 seconds, named with a SPIFFE ID.
//
// Linux only: SO_PEERCRED and /proc are Linux features.
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"log"
	"math/big"
	"net"
	"net/url"
	"os"
	"strings"
	"syscall"
	"time"
)

const (
	socketPath  = "/tmp/spire-lite.sock"
	trustDomain = "demo.local"

	// Sixty seconds. Long enough to be usable, short enough that you can watch
	// it rotate while reading the logs.
	svidTTL = 60 * time.Second
)

// A registration entry maps "a process that looks like THIS" to a SPIFFE ID.
type entry struct {
	cmdlineContains string
	spiffeID        string
}

// Order matters: the first match wins. The node process's command line can
// contain BOTH "server.ts" and the project folder name, so "server.ts" has to
// be checked first.
var entries = []entry{
	{"server.ts", "spiffe://" + trustDomain + "/service/typescript"},
	{"authserver", "spiffe://" + trustDomain + "/service/auth"},
	{"secure-services", "spiffe://" + trustDomain + "/service/go"},
}

type svid struct {
	SpiffeID   string `json:"spiffe_id"`
	Cert       string `json:"cert"`
	Key        string `json:"key"`
	Bundle     string `json:"bundle"`
	TTLSeconds int    `json:"ttl_seconds"`
}

type ca struct {
	key    *ecdsa.PrivateKey
	cert   *x509.Certificate
	bundle string // the CA certificate as PEM, for workloads to trust
}

// newCA creates the trust root in memory, at startup.
func newCA() (*ca, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	template := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "workload-api-ca"},
		NotBefore:             time.Now().Add(-time.Minute),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		return nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, err
	}
	return &ca{
		key:    key,
		cert:   cert,
		bundle: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})),
	}, nil
}

// issue mints one short-lived SVID for the given SPIFFE ID.
//
// Look at what is NOT in this certificate: no CommonName, no DNS name, no IP
// address. A SPIFFE certificate identifies a WORKLOAD, not a host.
func (c *ca) issue(spiffeID string) (*svid, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	uri, err := url.Parse(spiffeID)
	if err != nil {
		return nil, err
	}
	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		return nil, err
	}

	template := &x509.Certificate{
		SerialNumber: serial,
		NotBefore:    time.Now().Add(-30 * time.Second), // allowance for clock skew
		NotAfter:     time.Now().Add(svidTTL),
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage: []x509.ExtKeyUsage{
			x509.ExtKeyUsageServerAuth,
			x509.ExtKeyUsageClientAuth,
		},
		URIs:                  []*url.URL{uri}, // <- the identity lives here
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, template, c.cert, &key.PublicKey, c.key)
	if err != nil {
		return nil, err
	}
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
		return nil, err
	}

	return &svid{
		SpiffeID:   spiffeID,
		Cert:       string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})),
		Key:        string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})),
		Bundle:     c.bundle,
		TTLSeconds: int(svidTTL.Seconds()),
	}, nil
}

// attest asks the kernel who is on the other end of this socket.
//
// SO_PEERCRED is the important bit. The operating system reports the connecting
// process's pid and uid, and a process cannot lie about them. We then read that
// pid's command line from /proc to decide which registration entry applies.
func attest(conn *net.UnixConn) (pid int32, uid uint32, cmdline string, err error) {
	raw, err := conn.SyscallConn()
	if err != nil {
		return 0, 0, "", err
	}

	var creds *syscall.Ucred
	var credErr error
	if err := raw.Control(func(fd uintptr) {
		creds, credErr = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
	}); err != nil {
		return 0, 0, "", err
	}
	if credErr != nil {
		return 0, 0, "", credErr
	}

	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/cmdline", creds.Pid))
	if err != nil {
		return creds.Pid, creds.Uid, "", err
	}
	// /proc stores arguments separated by NUL bytes.
	return creds.Pid, creds.Uid, strings.ReplaceAll(string(data), "\x00", " "), nil
}

func (c *ca) handle(conn *net.UnixConn) {
	defer conn.Close()

	pid, uid, cmdline, err := attest(conn)
	if err != nil {
		log.Printf("    attestation failed: %v", err)
		return
	}

	for _, e := range entries {
		if !strings.Contains(cmdline, e.cmdlineContains) {
			continue
		}
		s, err := c.issue(e.spiffeID)
		if err != nil {
			log.Printf("    issue failed: %v", err)
			return
		}
		log.Printf("    issued  %-38s pid=%d uid=%d ttl=%s", s.SpiffeID, pid, uid, svidTTL)
		_ = json.NewEncoder(conn).Encode(s)
		return
	}

	log.Printf("    no registration entry matches pid=%d (%s)", pid, strings.TrimSpace(cmdline))
}

func main() {
	log.SetFlags(log.Ltime)

	c, err := newCA()
	if err != nil {
		log.Fatalf("could not create CA: %v", err)
	}

	// A leftover socket file from a previous run would block us.
	os.Remove(socketPath)

	listener, err := net.ListenUnix("unix", &net.UnixAddr{Name: socketPath, Net: "unix"})
	if err != nil {
		log.Fatalf("could not listen on %s: %v", socketPath, err)
	}
	defer os.Remove(socketPath)

	fmt.Printf("The Workload API is running on %s  (issues %s SVIDs)\n", socketPath, svidTTL)
	for _, e := range entries {
		fmt.Printf("  registered: cmdline contains %-18q -> %s\n", e.cmdlineContains, e.spiffeID)
	}

	for {
		conn, err := listener.AcceptUnix()
		if err != nil {
			log.Printf("    accept failed: %v", err)
			continue
		}
		go c.handle(conn)
	}
}

Claim	True?
Issues certificates with no credential from the caller	Yes
Identity survives a process moving to another machine	Yes, the ID has no address in it
Workload API writes no long-lived credential to disk	Yes, its CA is in memory; the old `certs/` directory remains until Lesson 13
Safe as a production attestation policy	No — one command-line substring is too weak
Highly available	No — it is one process, and Lesson 14 discusses the cost

Error	Meaning	Fix
`undefined: syscall.GetsockoptUcred`	You are not on Linux	Use WSL, a Linux VM, or a container
`bind: address already in use` on the socket	A stale socket file	The code calls `os.Remove(socketPath)` at startup; check nothing else is running
`no registration entry matches` for your own service	The process name is not in the table	Start it exactly as documented, or adjust the entry to your folder name
`permission denied` connecting to the socket	The socket belongs to another user	Run both as the same user

Certificates That Live Sixty Seconds

Learning objectives

The problem you have been carrying since Lesson 5

Certificates That Live Sixty Seconds

Learning objectives

The problem you have been carrying since Lesson 5

The actual fix

SPIFFE in two ideas

Idea 1: an identity is a URI, not a hostname

Idea 2: a certificate carrying that URI is called an X.509-SVID

The puzzle SPIFFE really solves: secret zero

Three words you will meet everywhere

Build the workload API

Create the CA in memory

Ask the kernel who is connecting

The registration table

Issue an SVID

Serve it

The complete workload API

Test it right now

What you have and have not built

Common errors

Lesson 11 checkpoint