Approve a certificate order

An order in a manual profile class is waiting for your approval, and you want to be sure that what you approve is exactly what gets issued.

An approval isn't a signed-in confirmation; it's your signature over the order's hash. The management application displays the content from exactly the bytes it signs. The management API only stores the signature; the CA worker verifies it against the rule set.

1. Open the order in the management application when the „approval waiting“ notification arrives. It goes to the approvers of the profile class.
2. Check the content shown: subject and SAN list, public key, profile class, issuing CA, extensions, and lifetime. The application fetched the order bytes unchanged, computed the SHA-256, compared it with the order ID, and displays the content from exactly those bytes.
3. Approve. The application signs the hash with your approval key; the smart card or PIV-capable security key asks for your PIN.
4. The application submits the signature through the management API. The order stays in pending_approval until every required approval is in.
5. Re-read the order instead of waiting for a response. The CA worker sets the transition to approval_complete, because only it knows the approval rules in its rule set.

Result. The order reaches issued or rejected, and the requester receives the „approval completed, certificate issued“ notification. The ledger holds your signature with the key ID, the order hash, and the rule set version.

• An order expires after its deadline, by default after 7 days.
• An approval for a canceled order is refused with 409.
• An order can't pick a milder approval rule: the rule prescribed for its profile class applies.
• Malware on the workstation can falsify how an order is displayed. A second, independent approval, as sensitive classes require, protects against that.

• PKI and certificate lifecycle – order states and the worker's checks
• Interfaces and integration – the approval flow through the API
• People and access – the approver role and approval keys
• A command is refused with 409