Sectigo's CA role

Sectigo contributes identity, not permission. It can validate an organisation and bind that identity to a signing key under a purpose-specific trust hierarchy. The customer, or its designated authorisation service, issues grants. The receiving service chooses which issuers it trusts and enforces its own decision.

What Sectigo validates

Use	What happens
Organisation verification	An org admin submits { legal_name, domain } (POST /v1/orgs/{org_id}/verification). Axiom asks the CA port for Sectigo organisation validation. validated makes the org verified and adds the domain to its verified domains; pending and failed do not. A domain verified by another org is refused.
Agent certificates	Binding a key with issue_certificate: true asks the CA for a client-authentication certificate: common name the agent ID, URIs urn:axiom:agent:{id} and urn:axiom:tenant:{id}, and the organisation name only when the tenant's org is verified.
Revocation	Revoking an x509 credential also revokes the certificate at the CA by serial number. A CA outage never blocks revoking the credential in Axiom, which is what stops new authority.
Trust anchors	GET /v1/public/ca/trust-anchors lists the purpose-specific anchors verifiers should pin.

Verified organisations unlock Control features: only a verified org can invite projects to enroll, and only verified domains can be routed to the org's SSO connection.

Purpose-specific trust

Agent certificates are enrolled as Sectigo Certificate Manager device certificates against a private-CA profile configured for client authentication only. They never chain to the Web PKI. Browser trust for public website TLS does not extend to agent credentials or to business permissions: a valid certificate says who holds a key, not what that key may do. The trust anchors endpoint says so in its own response.

A customer can instead configure a private CA, or rely on a workload identity issuer listed in the tenant's trust profile (Agents and credentials).

Legal entity assertions

The Agent identity check only reports an agent's legal entity as validated when an Axiom-signed agent card binds the agent to an organisation that Sectigo validated, with the evidence time and a freshness bound. A vendor's claim to operate an agent and a domain-control check are shown as separate, weaker assertions.

Configuration and status

The CA is a platform port (CertificateAuthority), selected by environment:

Setting	Effect
AXIOM_CA=sectigo-scm	Default. The Sectigo Certificate Manager adapter.
AXIOM_SCM_MODE=mock	Default. SCM's REST enrollment shape, backed by the local development CA, which issues real X.509 certificates.
AXIOM_SCM_MODE=live	Calls SCM: device enrollment, collection, revocation by serial, and organisation validations, with classic or OAuth auth.
AXIOM_CA=dev	The local development CA only.

Preview status

The hosted service runs SCM in mock mode until SCM credentials are configured. Certificates, organisation verification results and trust anchors in mock mode come from the development CA, and the credential's verification evidence records the CA's mode ("issued by … (mock)").

Receipts record the credential's kind, thumbprint and issuer at the time of the action. Issuers publish verification keys and status, support rotation and keep historical verification material; old signatures stay verifiable after a key is retired.