MTLS · CODE ISSUER
Access codes are the single-use keys people redeem for an entityOS mTLS client certificate. Sign in with your entityOS account to mint a new code, then pass it to the person who will register their certificate.
Under the hood
The issuer validates your entityOS session against entityos.cloud before anything is created. Only when entityOS answers status OK for a signed-in user is a code issued — an invalid or expired session, or no entityOS host configured, is refused.
One random version-4 GUID is generated per issue, from a cryptographically secure source. The GUID is the access code — there is nothing else to remember. It can also be downloaded as a password-protected zip, with a fresh random password shown once on this page.
A record is written to codes/<guid>.json in the issuer bucket, encrypted at rest and marked used: false, with your label and the time it was issued.
The holder enters the code at cert.register.sentinel.entityos.io, where their browser generates a key pair and receives a signed certificate — or a device enrols over SCEP with the code as its challenge password. Either way the code is then marked used and cannot be redeemed again.
Look up a code on the Revoke tab. An unused code is cancelled so it can never be redeemed. A redeemed code revokes its certificate: the record is marked revoked, a new CRL is signed by the CA and attached to every ALB trust store, and new connections presenting that certificate are refused. A revoked certificate can be restored the same way — it comes off the CRL at every trust store.