Manage Certificate Identity Pools for mTLS authentication on Confluent Cloud

You can create a certificate identity pool to map a client certificate with a Confluent Cloud identity that has granular permissions. By using certificate identity pools, you can enable varying levels of access to your Confluent Cloud resources for different client certificates issued by your Certificate Authority.

You can create, update, and delete certificate identity pools using the Confluent Cloud Console, the Confluent CLI, and the Confluent Cloud APIs. Follow the steps in the following sections to create, describe, list, and delete certificate identity pools for mTLS authentication.

Required RBAC roles: One of the following:

Create a certificate identity pool for mTLS

Required RBAC roles: One of the following:

You can create a certificate identity pool for mTLS using the Confluent Cloud Console, the Confluent CLI, and the Confluent Cloud APIs.

To create a certificate identity pool for mTLS:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.

  2. Select the identity provider that you want to use to create the certificate identity pool.

  3. Click Add identity pool if none exists; otherwise, click Add pool. The New identity pool page displays.

  4. Configure the certificate identity pool using the following fields:

    • Name: A name for the certificate identity pool.
    • Description: A description for the certificate identity pool.

  5. Under Add identity pool owner, grant the ResourceOwner role to the account that owns the certificate identity pool. This account can manage, edit, assign, and delete this account.

    • Account type: Select the account type that owns the certificate identity pool.
    • Account: Select the account that owns the certificate identity pool. Select the specific field or combination of fields extracted from certificates to uniquely identify clients during authentication. This value appears in the audit log records.

    Note that if you do not specify an account, only OrganizationAdmin and AccountAdmin roles can manage the account after creation.

  6. Under Set filters (required), set up filters to specify which identities can authenticate using your certificate identity pool. For details, see Create CEL Filters for mTLS Authentication on Confluent Cloud.

  7. Click Next. The summary page displays.

  8. Review the confirmation page and then click Validate and save. The certificate identity pool is created and added to the list of certificate is created and added to the list of identity pools.

Describe a certificate identity pool for mTLS

Get the details of a certificate identity pool for mTLS.

To describe a certificate identity pool for mTLS:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the certificate identity pool. The Overview page displays.

List certificate identity pools for mTLS

Get a list of the certificate identity pools for mTLS.

To see a list of your certificate identity pools for mTLS:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the certificate authority you want to see the certificate identity pools for. The Certificate Authority details page displays.

For the list of certificate identity pools, see the Identity pools section. The list of certificate identity pools includes the following details:

  • Name
  • Pool ID
  • Description

To see the details of a specific certificate identity pool, click the name of the certificate identity pool. The certificate identity pool details page displays. Click the name of the certificate identity pool to see the details.

Update a certificate identity pool for mTLS

Update the details of a certificate identity pool for mTLS, such as the provider, description, name, filter, and external identifier.

To update the details of a certificate identity pool for mTLS:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the certificate authority containing the identity pool you want to update.
  3. Click the name of the certificate identity pool you want to update. The Overview page displays.
  4. Click Edit next to any of the following fields to modify them:
    • Name: Update the name of the certificate identity pool
    • Description: Modify the description
    • Filter: Update the filter expression that determines which certificates can authenticate
    • External identifier: Change how clients are identified in audit logs
  5. To modify permissions:
    1. Click Edit existing access in the Access section
    2. Add or remove role bindings as needed
    3. Click Save to apply the permission changes
  6. To update the identity pool owner:
    1. Click Edit in the Identity pool owner section
    2. Select a new account type and account
    3. Click Save to apply the ownership change
  7. Review your changes and click Save to apply all modifications and return to the Certificate Authority page.

Note: Some fields may be read-only depending on your access level. Only identity pool owners, OrganizationAdmins, and AccountAdmins can modify certain settings.

Delete a certificate identity pool for mTLS

Delete a certificate identity pool for mTLS.

To delete a certificate identity pool for mTLS:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the certificate authority you want to delete the certificate identity pool for. The Certificate Authority details page displays.
  3. Hover over the name of the certificate identity pool you want to delete and click the trash icon to delete the certificate identity pool.

The certificate identity pool is deleted.

Using multiple certificate identity pools

When you use multiple certificate identity pools to map client certificates to granular permissions, here are some important considerations to keep in mind:

  • If multiple certificate identity pools are mapped, the client receives a union-of-permissions of all the mapped identity pools.

  • If a client certificate matches multiple certificate identity pools with different external identifier claims, the external identifier is prioritized as follows:

    Priority External identifier Maximum length
    1 CN 255 characters
    2 DN 255 characters
    3 Serial number  
    4 SAN 255 characters
    5 SHA-1 fingerprint  

    Note: If the CN, DN, or SAN exceeds 255 characters, the values used are truncated to 255 characters.

Related content