Automatic Certificate Rotation

SPIRE's automatic X.509-SVID rotation mechanism that continuously renews workload certificates before they expire, ensuring zero-downtime cryptographic identity refresh (SPIFFE X.509-SVID spec §4.1). The SPIRE Agent proactively monitors SVID lifetimes and triggers renewal at a configurable threshold (typically 50% of lifetime). New SVIDs are delivered to workloads via the streaming Workload API, enabling graceful transition without service interruption. This eliminates the manual certificate management that plagues traditional PKI deployments.

Try in Looking Glass
Auto-RotationZero Downtime

Sequence Diagram

Click any step for details

AgentCacheServerWorkloadTLS1SVID Lifetime Monitoring2Fresh Key Pair and CSR3New SVID Issuance4Workload SVID Update via Streaming API5Graceful TLS Transition
Request
Response
Redirect
Internal

Step-by-Step Breakdown

1
SVID Lifetime Monitoring
SPIRE AgentSVID Cache
2
Fresh Key Pair and CSR
SPIRE AgentSPIRE Server
3
New SVID Issuance
SPIRE ServerSPIRE Agent
4
Workload SVID Update via Streaming API
SPIRE AgentWorkload
5
Graceful TLS Transition
WorkloadTLS Stack

Token Inspector

Specs for this flow

Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.