Choose the authentication mode
Platform managed is recommended. You retain an RSA mTLS private key and submit a certificate signing request (CSR). Wavac issues an exact 24-hour client certificate that your client presents when requesting access tokens. You do not create or rotate a customer JWT signing key.
Customer managed remains available when your organization must own the JWT signer. You enroll an RSA public JWK and use the private key to sign short-lived client assertions. Wavac never receives either mode's private key.
Before you begin
Obtain the enrollment endpoint, one-time token, and authentication mode from your administrator. You do not need a certificate or signing key to begin platform-managed bootstrap. The token expires after 24 hours and is invalid after its first successful use.
Never log the token, request body, CSR, private key, key-store export, or passphrase. A CSR and public JWK do not contain private-key material, but they still belong only in the enrollment exchange.
Enroll platform-managed mTLS
First POST {"token":"<one-time-enrollment-token>"} to the enrollment endpoint
to obtain certificateSubject. This preparation does not consume the token.
Generate an RSA key of at least 2048 bits where it will be used. Create a CSR
with the exact certificateSubject supplied by Wavac and only these requested
extensions:
| Extension | Required value |
|---|---|
| Basic constraints | CA false |
| Key usage | Digital signature |
| Extended key usage | TLS client authentication |
POST /api/customer/enrollment
Content-Type: application/json
{
"token": "<one-time-enrollment-token>",
"publicKeyJwk": null,
"publicKeyThumbprint": null,
"certificateChainPem": null,
"certificateSigningRequestPem": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----\n"
}
A 200 OK response includes authenticationMode: PlatformManaged,
credentialState: Active, and the public certificateChainPem. Issuing the
one-time handoff authorizes bootstrap, and submitting it with a valid CSR is the
customer's approval and proof of private-key possession. Verify that the leaf matches your private key,
uses the required subject and client-auth extensions, and is valid for exactly
24 hours before storing it with the private key.
Enroll a customer-managed signer
Generate an RSA signing key of at least 2048 bits and submit only its public JWK
with use: sig, alg: RS256, and the RFC 7638 SHA-256 thumbprint as kid.
Set certificate and CSR fields to null. See request an access
token for the assertion contract.
Approval and failures
Enrollment completion and certificate renewal share the credential-operation allowance. Budget setup attempts and recovery alongside scheduled renewals.
Platform-managed enrollment activates after the customer completes the one-time CSR exchange. Customer-managed JWK enrollment records public material for review and remains pending until administrator approval.
An enrollment failure intentionally does not distinguish invalid, expired, used, or revoked tokens. Do not retry a failed one-time exchange automatically. Request a new handoff and generate new key material when the first result is ambiguous.