MTLS · CODE ISSUER
Sign in with your entityOS account, then either generate an entityOS mTLS client certificate here — the key pair is made in this browser and packaged as a ready-to-install .p12 — or issue a single-use access code for someone to redeem at cert.register on their own device.
-x):
security import ~/Downloads/<file>.p12 -k ~/Library/Keychains/login.keychain-db -x -P '<password>'Test access
Once the certificate is installed and the browser has been restarted, open https://cert.access.sentinel.entityos.io. The browser will ask which certificate to present — choose the one just installed. The page confirms the verified serial and subject.
Test accessNo certificate prompt, or a connection error? The certificate isn't installed in the store the browser uses — recheck the steps above, then restart the browser.
Optional
The certificate was issued by the entityOS mTLS private CA. The CA certificate is bundled inside the .p12; download it separately if a tool needs the CA on its own.
macOS: Double-click the downloaded .pem → Keychain Access → expand Trust → set When using this certificate to Always Trust. Windows: Double-click → Install Certificate → Place in Trusted Root Certification Authorities. macOS: Double-click the downloaded .pem → Keychain Access → expand Trust → set When using this certificate to Always Trust. | Windows: Double-click → Install Certificate → Place in Trusted Root Certification Authorities.
Under the hood
The issuer validates your entityOS session against entityos.cloud before anything is created. Only when entityOS answers status OK for a signed-in user is a code issued — an invalid or expired session, or no entityOS host configured, is refused.
One random version-4 GUID is generated per issue, from a cryptographically secure source. The GUID is the access code — there is nothing else to remember. It can also be downloaded as a password-protected zip, with a fresh random password shown once on this page.
A record is written to codes/<guid>.json in the issuer bucket, encrypted at rest and marked used: false, with your label and the time it was issued.
The holder enters the code at cert.register.sentinel.entityos.io, where their browser generates a key pair and receives a signed certificate — or a device enrols over SCEP with the code as its challenge password. Either way the code is then marked used and cannot be redeemed again.
Look up a code on the Revoke tab. An unused code is cancelled so it can never be redeemed. A redeemed code revokes its certificate: the record is marked revoked, a new CRL is signed by the CA and attached to every ALB trust store, and new connections presenting that certificate are refused. A revoked certificate can be restored the same way — it comes off the CRL at every trust store.
Certificate (.p12)
Choosing Certificate (.p12) makes this browser generate an RSA-2048 key pair with the Web Cryptography API (window.crypto.subtle). The private key stays in this browser: it is never sent to entityOS.
The browser builds a PKCS#10 CSR containing the public key and sends it with your entityOS session. The certificate name is your label, or your entityOS username if the label is empty.
The issuer re-validates your session, verifies the CSR signature and signs the public key with the entityOS mTLS CA — an X.509 client certificate (clientAuth) valid for 365 days by default. A used code record (the reference code shown on this page) and an issuance record (serial, public certificate) are written to encrypted S3, so the certificate can be revoked from the Revoke tab. The issuer only ever sees the public key.
The signed certificate comes back to this browser, which packages it with the CA certificate and the private key into a PKCS#12 (.p12) protected by a random password, shown once. Download it when you are ready and import it with the steps shown — the key is marked non-exportable in the keychain or certificate store — then delete the file. If it is for someone else, send the file and the password separately.