PKI (public key infrastructure)

Public key infrastructure (PKI) is a way of proving identity with certificates. A trusted certificate authority (CA) signs a certificate for each participant, and anyone who trusts the CA can check that a certificate is genuine without asking the CA. It’s the same idea behind HTTPS on websites, and Managed Nebula uses it to identify every host on a network.

How PKI works in Managed Nebula

Each host generates its own key pair when it enrolls, and the private key never leaves the host. Defined Networking’s CA signs a certificate for the host’s public key that records the host’s name, its overlay IP addresses, and its groups, meaning its role and tags. Signatures use Ed25519 or ECDSA P-256.

Every host trusts the network’s CA certificates, so two hosts can verify each other’s certificates on the spot during a handshake. Changing anything in a certificate breaks the CA’s signature, which is why a host can’t claim another host’s IP address or give itself a role it doesn’t have.

Defined Networking holds the CA private keys and handles the rest of the lifecycle. It issues and rotates host certificates, which DNClient picks up automatically, and rotates the CAs themselves periodically (see Certificate rotation). When you block a host, every other host stops trusting its certificate. Securing the keys to your kingdom explains how the CA keys are protected.

Why PKI instead of shared keys

Tools that authenticate with pre-shared public keys need every peer’s key copied to every other peer. Adding one host to a network of 1,000 means updating 1,000 hosts, and the work grows with the network.

With PKI, hosts only need to trust the CA. Certificates are exchanged during the handshake, so a new host can connect to existing hosts as soon as it’s enrolled, and nothing about it has to be sent to them first.

Certificate versions

Nebula has two certificate formats. Version 2, introduced in Nebula 1.10, supports IPv6 and more than one overlay address per host, and an IPv6 overlay requires it. Networks created before IPv6 support use version 1.

If you run open-source Nebula yourself, you manage this PKI by hand with nebula-cert: creating the CA, keeping its key safe, and signing and rotating every host’s certificate. Managed Nebula does that part for you.