SPIFFE/SPIRE

Secure Production Identity Framework for Everyone - Workload identity with X.509 and JWT SVIDs

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

X.509-SVID Issuance

Acquire an X.509 certificate encoding a SPIFFE ID as a URI SAN via the Workload API (SPIFFE X.509-SVID spec §2). X.509-SVIDs are the primary credential type in SPIFFE, used for mTLS authentication between workloads. The SPIRE Agent generates the key pair, obtains a signed certificate from the SPIRE Server's CA, and delivers the complete credential set (certificate, private key, trust bundle) to the workload via the local Unix socket.

X.509 CertificateWorkload IdentitymTLS Ready

View flow diagram

JWT-SVID Issuance

Acquire a signed JWT token encoding a SPIFFE ID via the Workload API (SPIFFE JWT-SVID spec §2). JWT-SVIDs are an alternative to X.509-SVIDs designed for HTTP/gRPC-based authentication where presenting a client certificate is impractical (e.g., L7 proxies, API gateways). The workload specifies the intended audience, and SPIRE Server mints a signed JWT with the workload's SPIFFE ID as the subject. JWT-SVIDs are short-lived (typically 5 minutes) and audience-bound.

JWT TokenAPI AuthenticationShort-Lived

View flow diagram

mTLS Handshake with X.509-SVIDs

Mutual TLS authentication between two workloads using X.509-SVIDs as client and server certificates (SPIFFE X.509-SVID spec §5). Both services present their SPIFFE-issued certificates and verify the peer's certificate against the SPIFFE trust bundle (not system CAs). After cryptographic verification, each side extracts the peer's SPIFFE ID from the URI SAN and performs authorization based on the identity. This provides authentication, encryption, and integrity in a single handshake.

Mutual TLSZero TrustService-to-Service

View flow diagram

Automatic Certificate Rotation

SPIRE's automatic X.509-SVID rotation mechanism that continuously renews workload certificates before they expire, ensuring zero-downtime cryptographic identity refresh (SPIFFE X.509-SVID spec §4.1). The SPIRE Agent proactively monitors SVID lifetimes and triggers renewal at a configurable threshold (typically 50% of lifetime). New SVIDs are delivered to workloads via the streaming Workload API, enabling graceful transition without service interruption. This eliminates the manual certificate management that plagues traditional PKI deployments.

Auto-RotationZero DowntimeStreaming API

View flow diagram

Specs & references

Authoritative reading list for SPIFFE/SPIRE — core specs, security considerations, and companion standards.

SPIFFE/SPIRE

Available Flows

X.509-SVID Issuance

JWT-SVID Issuance

mTLS Handshake with X.509-SVIDs

Automatic Certificate Rotation

Specs & references

Core specs

Security & privacy

Companion specs

SPIFFE/SPIRE Features

Workload Identity

X.509-SVID

JWT-SVID