Operations and emergencies

Summary. This page describes how WKL TrustBridge responds to outages and compromise: which function remains available when which component fails, how much time there is for recovery, how revocation of certificates and relationships works when central services are missing, and how a compromised CA key is handled. The guiding principle is that status information is more robust than issuance: a missing issuance causes delay, a missing revocation causes harm. The default values at the end of the page apply as long as an organization sets nothing else.

• RPO (recovery point objective) – the maximum tolerable data loss, measured in time.
• RTO (recovery time objective) – the maximum tolerable time until recovery.
• Standby – a prepared second instance that takes over on failure but does not run in parallel.
• Emergency revocation – revocation directly at the worker host, without database or management.

graph TD
  W[CA worker fails] --> L[last CRL valid<br/>until nextUpdate]
  L --> T1[0 to 66 h:<br/>validations succeed]
  L --> T2[after 66 h without a new list:<br/>validations fail closed]
  B[Standby worker] -->|target: well under 66 h| N[new CRL]
  N --> T1
  classDef ok fill:#dff6dd,stroke:#107c10,color:#201f1e
  classDef ko fill:#fde7e9,stroke:#a4262c,color:#201f1e
  class T1 ok
  class T2 ko
  classDef tcb fill:#fde7e9,stroke:#a4262c,color:#201f1e
  class B,W tcb
  classDef neu fill:#f3f2f1,stroke:#605e5c,color:#201f1e
  class L,N neu

Fail closed. If a CRL expires and no new one is available, relying parties reject. That is intentional: a relying party that accepts without valid status would accept revoked certificates. The price is an availability risk, which the 66-hour buffer and the standby contain.

The ledger is the single source of truth about issuance and revocation. After a restore from backup it may lag behind the database. The worker then proceeds as follows:

1. It records the restore, together with the last known anchor, as an event of its own; falling back behind an anchor is thus explained, not hidden.
2. It takes over projected certificates from the database whose CA signature is valid before processing new orders. That way a serial number that has already been used is never assigned again.
3. It produces a new CRL with a CRL number above every number already published.

If the database or the management interface is unavailable, an authorized person revokes at the console of the worker host. The revocation order goes straight into the ledger; the new CRL reaches distribution over the second path. This requires physical or secured remote access to the worker host and a rehearsed procedure; the steps are in Revoke a certificate.

Relationship revocation needs neither the other side nor the database. If management is unavailable, an authorized person revokes at the console of the worker host; the worker produces a new trust bundle without the relationship, and the TLS adapters fetch it over the second path. Until the adapters have received the new bundle, the lifetime of the old bundle bounds the effect. The steps are in Revoke a trust relationship.

A compromise shows up in the hourly reconciliation of the HSM's signature counters against the ledger, or is reported from outside. The response has six steps – detect, contain, report, revoke, rebuild, follow up – described in Respond to a compromised CA key. An issuing CA is revoked only in a ceremony at the root; the partners' hierarchies are not affected.

If the root is compromised, the organization's hierarchy has to be rebuilt and the new anchor brought into all of its relationships. The partners' hierarchies are not affected. Offline operation, the multi-person rule, and the safes protect against this.

Every organization runs the following tests before going live and at least once a year after that. Exercises involving the root use a test root.

The following values apply as long as an organization sets nothing else. Deviations are entered in the rule set or the relationship policy and recorded in the ledger.

• The operations organization of any particular organization. Each organization names its own roles, custodians, and standby; in the Managed model, the operating partner takes on the agreed roles, never approval or custody.
• An operating partner's response times. They are governed by the contract with that partner.
• Values outside the limits of the rule set; an organization can tighten defaults and adjust them within the limits, but cannot remove them.