Reference
Glossary
Definitions are necessary but insufficient — each entry points at the system behind the term.
- ACME
- A protocol (RFC 8555) for automated proof of control, certificate ordering, issuance, and renewal.
- ARI
- ACME Renewal Information (RFC 9773): a CA-supplied suggested renewal window that clients poll.
- Certificate Transparency
- Append-only public logs of issued certificates, verifiable with Merkle inclusion and consistency proofs.
- Crypto agility
- The ability to change cryptographic algorithms, keys, and protocols without redesigning systems.
- Harvest now, decrypt later
- Capturing encrypted traffic today to decrypt once a quantum computer becomes available.
- Inclusion proof
- The sibling hashes needed to recompute a Merkle root and prove one record is in the tree.
- Intermediate CA
- A CA certificate signed by a root and used for day-to-day issuance, keeping roots offline.
- Machine identity
- The credential that lets a workload, device, or service authenticate itself — usually a certificate.
- ML-KEM
- The NIST-standardized module-lattice key encapsulation mechanism, FIPS 203.
- Path building
- The client-side process of assembling a chain from a presented leaf to a trusted root.
- SCT
- Signed Certificate Timestamp: a log's promise to include a certificate, required by browsers.
- Trust store
- The set of root certificates a client trusts, governed by a root program.