Mutual TLS (mTLS) Architecture

Carpenter enforces a strict Zero-Trust Ingress Standard. Underlying hosting networks, cloud VPC peerings, and physical data center boundaries are untrusted. Transport security is anchored in mutual TLS using client certificates issued by our central Certificate Authority (CA).

All edge ingress controllers, bare-metal reverse proxies, and regional AWS Application Load Balancers maintain real-time telemetry pipelines directly attached to the Carpenter Security Information and Event Management (SIEM) fabric.

Any ingress attempt lacking a valid, unrevoked hardware-backed client certificate triggers automated security capture:

Captured Attributes: Source IP address, Anycast POP identifier, raw TLS Client Hello parameters, and client TLS/TCP fingerprints (JA3/JA4).
Incident Processing: Handshake rejections are written to immutable audit stores and evaluated against anomalous probing heuristics. Repeated or deliberate unauthenticated requests are automatically flagged for host-level blacklisting and operational escalation.

Strictly for Authorized Personnel. Access to this platform is governed by the Carpenter Internal Systems Acceptable Use Policy.

Trust Store Synchronization

A single internal CA signs all developer and machine credentials. The public trust bundle is propagated automatically across all operational environments:

1. AWS Multi-Region Propagation

The Root and Intermediate CA bundles are managed via AWS Certificate Manager (ACM) and replicated across active regions (us-east-1, eu-west-1, ap-northeast-1).
Application Load Balancers (ALBs) consume the regional trust store to enforce mTLS at the VPC ingress boundary.

2. Bare-Metal Host Management

Dedicated hardware nodes pull the latest CA certificates via automated configuration agents.
Ingress proxies (Caddy/Nginx) mount the CA bundle from read-only host storage (/etc/ssl/certs/carpenter-ca.pem) to validate incoming client connections directly on bare metal.

Client Setup Instructions

Workstation Browsers (macOS / Linux / Windows)

Import the provisioned .p12 bundle into your system keychain or browser certificate store.
The browser prompts for identity presentation when navigating to any target resolving under your assigned <zone-domain>.

CLI & Development Containers

# Inject client certificates into dev environments
COPY ./certs/carpenter-client.pem /etc/ssl/certs/carpenter-client.pem
COPY ./certs/carpenter-client.key /etc/ssl/private/carpenter-client.key
ENV SSL_CERT_FILE=/etc/ssl/certs/carpenter-client.pem