feat(core): Assign certificate to namespace

[pflynn-virtru]

Overview

Certificates can be associated with attribute namespaces to establish a chain of trust. These root certificates are stored in x5c format (base64-encoded DER) in the database and can be managed via the otdfctl CLI.

This implementation follows the KAS key assignment pattern with minimal commands for core operations.

Prerequisites

• Platform service must be running with the certificate database tables migrated feat(policy): namespace root certificates platform#2771

Commands

The certificate management follows the same pattern as KAS key assignment with three focused commands:

Assign Certificate to Namespace

Assign a root certificate to a namespace:

./otdfctl policy certificates assign \
  --namespace "https://example.com" \
  --file ../platform/keys/kas-cert.pem \
  --label "source=kas-cert" \
  --with-client-creds '{"clientId":"opentdf","clientSecret":"secret"}' \
  --host http://localhost:8080

Output:

SUCCESS

╭────────────────────────┬───────────────────────────────────────────────╮
│Namespace ID            │8f1d8839-2851-4bf4-8bf4-5243dbfe517d           │
│Certificate ID          │b891df13-8ad5-4c95-8add-631862207284           │
│Certificate (preview)   │MIIC/TCCAeWgAwIBAgIUSMNrGBq+5ax1wDa…          │
╰────────────────────────┴───────────────────────────────────────────────╯

Remove Certificate from Namespace

Remove a certificate from a namespace:

./otdfctl policy certificates remove \
  --namespace "https://example.com" \
  --certificate-id "b891df13-8ad5-4c95-8add-631862207284" \
  --with-client-creds '{"clientId":"opentdf","clientSecret":"secret"}' \
  --host http://localhost:8080

Output:

SUCCESS

╭────────────────┬───────────────────────────────────────────────╮
│Removed         │true                                           │
│Namespace       │https://example.com                            │
│Certificate ID  │b891df13-8ad5-4c95-8add-631862207284           │
╰────────────────┴───────────────────────────────────────────────╯