Integrating AWS Private CA with SPIRE and baseca at Coinbase
summary
Coinbase describes a working system that ties AWS Private CA, SPIRE, and a new gRPC PKI layer called baseca to issue hundreds of thousands of short‑lived certificates a day for X.509 client auth and code signing. baseca keeps subordinate CAs in memory (optionally inside Nitro enclaves), streams issuance metadata to Kinesis→S3 for revocation, and avoids Private CA quotas by signing downstream. SPIRE runs a nested CA topology: a root SPIRE syncs with Private CA (7‑day CA) and many mains issue 24‑hour leaf certs via local agents.
AI-written summary · about
chapters (9)
- 0:00Introduction to Coinbase
- 0:39Security requirements
- 3:09Public key infrastructure
- 4:41Defining BaseCA and Spire
- 5:19BaseCA use cases and design
- 9:52Spire use cases
- 12:01Benefits of Spire
- 13:17Spire nested architecture
- 18:17Conclusion
related talks
34mScaling SPIRE for Performance and Availability
26mFrom Adoption to Innovation: LinkedIn’s SPIRE Journey
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
33mSPIFFE and SPIRE: Architecture Deep Dive
29mBeyond Proof of Concept: Keys to a Successful SPIRE Rollout in Production
16mUsing SPIRE in Production at Uber
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE