Module tls_cert 

auths tls-cert — KEL-rooted X.509 leaf certificates for TLS composition.

TLS already authenticates endpoints through the WebPKI/CA system. This command lets a KERI AID compose with that pipe rather than replace it: it issues an X.509 leaf whose trust roots in the AID’s key event log (a did:keri:<aid> SAN plus a binding extension carrying the replayed key-state), so a stock TLS stack — rustls, OpenSSL, BoringSSL, Go crypto/tls — completes a handshake with it, while an AID-aware peer re-derives the trust by replaying the KEL. That is how an auths identity deploys through every load balancer, mesh, and client that already speaks TLS.

Two directions, both offline/hermetic (the KEL handed in is a local artifact):

• auths tls-cert issue --from-kel kel.json --sign-key aid.key.pem — us → peer: replay the KEL, project its current key-state into a KEL-rooted leaf, have the AID’s current signing key authorize the leaf’s TLS key (a KERI signature over the leaf SPKI), and emit the cert PEM plus the ephemeral TLS private key PEM the acceptor serves.
• auths tls-cert verify --cert cert.pem --from-kel kel.json — peer → us: the adversarial verifier. Parse a peer’s leaf, replay the KEL we hold for its AID, and confirm the cert binds to that exact replayed key-state (AID, current keys, KEL tip, the did:keri SAN) and that the AID authorized the leaf’s TLS key. Rejects a forged binding (matching key-state over an attacker’s TLS key), a revoked/rotated AID, a stripped binding/authorization, and a SAN spoof. Trust is rooted in the log, never in a CA.

The wire/crypto definition lives in auths-keri::tls_cert; this is a thin CLI adapter over it. The cert’s subject key is a fresh ephemeral TLS keypair, so the AID’s long-term signing key never goes on the wire — only its detached authorization signature over the public TLS key does.

Structs

IdentityArgs

auths tls-cert identity — read the did:keri AID out of a leaf’s SAN.

IssueArgs

auths tls-cert issue — mint a KEL-rooted leaf for one of our AIDs.

QuicArgs

auths tls-cert quic — carry the same composition over QUIC/HTTP3.

TlsCertCommand

Issue or verify a KEL-rooted X.509 certificate (TLS composition).

VerifyArgs

auths tls-cert verify — confirm a peer’s leaf is rooted in a KEL we hold.

Enums

TlsCertAction

The directions of KEL-rooted mTLS composition.