Stage 2 · mTLS Access

Issue an
access code.

Access codes are the single-use keys people redeem for an entityOS mTLS client certificate. Enter the issuer password to mint a new code, then pass it to the person who will register their certificate.

Format GUID · v4
Use Single use
Gate Issuer password
Redeem codes at cert.register.sentinel.entityos.io Each code issues exactly one client certificate, then it is spent.
Access Code

Held by your administrator. Never stored with the code.

Saved on the code record so you can tell codes apart.

Under the hood

How an access code is issued

01
Password check

The password in the request is compared in constant time against the issuer password set at deploy time. If it doesn't match, or no password is configured, no code is created.

Server
02
Code generation

A random version-4 GUID is generated with a cryptographically secure source. The GUID is the access code — there is nothing else to remember.

Server
03
Record written

A record is written to codes/<guid>.json in the issuer bucket, encrypted at rest and marked used: false, with your label and the time it was issued.

Server
04
Redemption

The holder enters the code at cert.register.sentinel.entityos.io, where their browser generates a key pair and receives a signed certificate. The code is then marked used and cannot be redeemed again.

Browser