MTLS · CODE ISSUER
Access codes are the single-use keys people redeem for an entityOS mTLS client certificate. Sign in with your entityOS account to mint a new code, then pass it to the person who will register their certificate.
Under the hood
The issuer validates your entityOS session against entityos.cloud before anything is created. Only when entityOS answers status OK for a signed-in user is a code issued — an invalid or expired session, or no entityOS host configured, is refused.
Between 1 and 10 random version-4 GUIDs are generated with a cryptographically secure source. Each GUID is an access code — there is nothing else to remember. They can also be downloaded as a password-protected zip, with a fresh random password shown once on this page.
A record is written to codes/<guid>.json in the issuer bucket, encrypted at rest and marked used: false, with your label and the time it was issued.
The holder enters the code at cert.register.sentinel.entityos.io, where their browser generates a key pair and receives a signed certificate — or a device enrols over SCEP with the code as its challenge password. Either way the code is then marked used and cannot be redeemed again.
Look up a code on the Revoke tab. An unused code is cancelled so it can never be redeemed. A redeemed code revokes its certificate: the record is marked revoked, a new CRL is signed by the CA and attached to every ALB trust store, and new connections presenting that certificate are refused. A revoked certificate can be restored the same way — it comes off the CRL at every trust store.