Home Knowledge Base SecureW2 Documentation ACME-Driven SVID Enrollment for AI Agents

ACME-Driven SVID Enrollment for AI Agents

Introduction

SecureW2 supports issuing SPIFFE-compliant X.509 SVIDs (SPIFFE Verifiable Identity Documents) to AI agents for secure device-to-device authentication. This guide describes how to enroll an AI agent using ACME with External Account Binding (EAB) and the acme.sh client, where CrowdStrike, used here as an example, is configured as the Signal Source. You can configure any supported platform instead.

The agent’s system_serial_number attribute from the platform you choose (CrowdStrike, in this example) populates the SPIFFE URI in the certificate’s Subject Alternative Name (SAN).

Prerequisites

The following are the prerequisites for setting up SVID issuance for AI agents with JoinNow:

  1. An active JoinNow PKI Ultimate subscription.
  2. An ACME client for enrolling server certificates.
  3. An active subscription to the platform you configure. This document uses the CrowdStrike Falcon platform as an example.

Configuring SecureW2

To issue SPIFFE-compliant SVIDs to AI agents, you’ll need to configure the following in SecureW2. You can configure any platform of your choice — this document uses CrowdStrike as an example.

  1. Creating an ACME (Pre-authorized) Server Certificate Enrollment Token sets up the EAB token that the ACME client uses to authenticate with JoinNow.
  2. Configuring a Security Platform as the Lookup Source integrates the platform—CrowdStrike, in this example—as a Security Vendor, enabling SecureW2 to retrieve device attributes for identity verification.
  3. Creating a Security Signal Source links the EAB token to the platform you configure as the lookup source—CrowdStrike, in this example—to verify a device’s identity before issuing an SVID.
  4. Creating a Certificate Template defines the SVID’s structure, including the SPIFFE URI (scheme, trust domain, and path) and validity period.
  5. Policy Management configures the Policy Workflow and Enrollment Policy that determine how and to whom SVIDs are issued.

Creating an ACME (Pre-authorized) Server Certificate Enrollment Token

Before an AI agent can enroll for an SVID via ACME, you need to create a pre-authorized Server Certificate Enrollment token with External Account Binding (EAB). This token allows the ACME client (acme.sh) to authenticate with JoinNow and request a certificate on behalf of the agent.

To create an ACME (Pre-authorized) Server Certificate Enrollment token, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Device Management Platforms.
  3. Click Add.
  4. In the Basic section, enter the name of the token in the Name field.
  5. In the Description field, enter the description for the token.
  6. From the Type drop-down list, select ACME (Pre-authorized) Server Certificate Enrollment Token.
  7. Click Save. A .csv file downloads containing the Key ID, HMAC Key, and Server URL. You’ll use these values to install the certificate on AI agents via the acme.sh client, using this EAB token.

Configuring a Security Platform as the Lookup Source

SecureW2 supports any platform you configure as the lookup source to verify AI agent devices during enrollment. CrowdStrike is featured throughout this guide to illustrate the setup. Configuring CrowdStrike as a Security Vendor allows SecureW2 to retrieve the device’s system_serial_number attribute, which is used to populate the SPIFFE URI in the issued certificate.

To create a CrowdStrike security vendor, perform the following steps:

  1. Navigate to Integration Hub > Security Platforms.
  2. Click Add.
  3. In the Basic section, enter the name of the security vendor in the Name field.
  4. In the Description field, enter the description for the security vendor.
  5. Click Save. The page refreshes, and the Configuration, Risk Configuration, and Attribute Mapping tabs are displayed.

Configuring the CrowdStrike Connection

This section describes how to configure the connection settings for the CrowdStrike security vendor. You’ll provide the Provider URL, Client ID, and Client Secret obtained from the CrowdStrike console, then validate the connection to ensure JoinNow can communicate with CrowdStrike.

To establish the CrowdStrike integration, perform the following steps:

  1. Select the Configuration tab:
    1. In the Provider URL field, enter the base URL obtained from the CrowdStrike console.
    2. In the Client ID field, enter the client ID obtained from the CrowdStrike console.
    3. In the Client Secret field, enter the secret obtained from the CrowdStrike console.
    4. Click Validate to check for a successful connection.

Configuring CrowdStrike Risk Scores

By default, the JoinNow Management Portal provides predefined risk scores and risk levels. You can create a new risk score to define custom risk thresholds based on your business requirements.

To create a new risk score, perform the following steps:

  1. Select the Risk Configuration tab.
  2. On the Risk Configuration page, click Add.
  3. In the Remote Attribute field, the overall option is selected by default. The CrowdStrike security vendor specifically uses this attribute to return the risk score value from the Overall assessment section in the CrowdStrike console to the JoinNow Management Portal.
  4. In the Attribute Type field, the type of risk score value returned by the CrowdStrike security vendor to the JoinNow Management Portal is displayed. The default value displayed is the Number type.
  5. In the Remote Value field, enter the risk score range for the required risk level (1-100).
  6. From the Composite Risk Exposure level drop-down list, select the required risk level.
  7. Click Next.

To modify a default risk score instead of creating a new one, click the edit icon for the corresponding remote attribute on the Risk Configuration page and follow the same steps as above.

Mapping Attributes

For SVID issuance to AI agents, select the system_serial_number attribute in the Attribute Mapping section. This attribute is used to populate the SPIFFE URI in the issued certificate.

To enable the system_serial_number attribute, perform the following steps:

  1. Select the Attribute Mapping tab.
  2. From the Attribute Type drop-down list, retain the Device option, select the system_serial_number attribute, and click Update. You can add multiple attributes as needed.

Creating a Security Signal Source

A Security Signal Source links the ACME EAB token with the lookup platform you configure — CrowdStrike, as featured in this guide — so SecureW2 can verify a device’s identity before issuing an SVID. This ensures that certificates are issued only to recognized devices; if a device isn’t found, enrollment is rejected.

To create a Security Signal Source, perform the following steps:

  1. Navigate to Policy Management > Security Signal Sources.
  2. Click Add Security Signal Source.
  3. In the Basic section, enter the name of the security signal source in the Name field.
  4. In the Display Description field, enter a suitable description for the security signal source.
  5. In the Lookup Purpose field, select Certificate Issuance.
  6. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
  7. Select the Conditions tab:
    1. From the Provider drop-down list, select the Agentic AI EAB token created in the Creating an ACME (Pre-authorized) Server Certificate Enrollment Token section.
  8. Select the Settings tab:
    1. From the Provider drop-down list, select the CrowdStrike security platform created in the Configuring CrowdStrike as the Lookup Source section.
    2. From the Lookup Type drop-down list, select Device.
    3. From the Identity drop-down list, select SAN-DNS.
    4. Click Validate Configuration to verify the lookup is valid.
    5. In the Validate Configuration pop-up window, enter the device’s serial number in the Enter a valid identity field, then click Validate to verify the account.
  9. Click Update.

Creating a Certificate Template

A certificate template defines how information is encoded in a certificate issued by the Certificate Authority (CA). It includes a list of certificate attributes and specifies how information must be encoded. 

SecureW2 recommends creating a new certificate template for this purpose rather than modifying an existing one.

For AI agents, this template includes a SPIFFE URI composed of the scheme, trust domain, and path. The path (which acts as the workload identifier) is dynamically populated with an attribute retrieved from the configured platform at issuance. This guide illustrates the setup using CrowdStrike.

To create a new certificate template, perform the following steps:

  1. Navigate to Dynamic PKI > Certificate Authorities.
  2. Scroll to the Certificate Templates section and click Add Certificate Template.
  3. In the Basic section, enter the name of the certificate template in the Name field.
  4. In the Validity Period field, enter the certificate’s validity period. SecureW2 recommends a 12-hour validity period (shorter), and you can configure this based on your requirements.
  5. In the SAN section, enter spiffe://poc.securew2.com/device/${/auth/endpointProtectionPlatform/system_serial_number} in the URI field.

    This is a sample value you can configure to meet your requirements. It is made up of three parts: the scheme (spiffe://), the trust domain (poc.securew2.com), and the path (/device/${/auth/endpointProtectionPlatform/system_serial_number}), which serves as the workload identifier and is dynamically populated with the device’s serial number at issuance.
  6. In the Extended Key Usage section, select Server Authentication and Client Authentication in the Use Certificate For field.
  7. Retain the default values for the remaining fields in the certificate template.
  8. Click Save.

Policy Management

This section describes the configuration process for policies related to SVID enrollment for AI agents. Through Policy Management, you can set rules for the Policy Workflow to select the appropriate certificate template for issuing SVIDs to AI agents.

Creating a Policy Workflow

Policy Workflow segments AI agents based on defined criteria or attributes retrieved from the configured platform’s lookup. It allows you to define and create roles based on these attributes. This guide illustrates the setup using CrowdStrike.

To create a policy workflow, perform the following steps:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the Policy Workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the Policy Workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed. 
  7. Select the Conditions tab.
    1. From the Provider drop-down list, select the Agentic AI EAB token created in the Creating an ACME (Pre-authorized) Server Certificate Enrollment Token section.
  8. In the Security Platform section:
    1. Enable the checkbox beside Security Platform. This allows you to select CrowdStrike as an additional condition for the Policy Workflow, so the AI agent is verified via the CrowdStrike lookup before certificate issuance.
    2. From the Security Platform drop-down list, select the CrowdStrike security platform created in the Configuring CrowdStrike as the Lookup Source section.
    3. In the Risk Level list, select the appropriate risk level for the Policy Workflow. For example, you can create a Policy Workflow with the Low risk level, then map it to an Enrollment Policy to allow SVID issuance for AI agents that meet that risk level.
  9. Click Update.

Creating an Enrollment Policy

An Enrollment Policy determines how SVIDs are issued to AI agents. Each role defined in the Policy Workflow is assigned a unique Enrollment Policy for this purpose.

To create an enrollment policy, perform the following steps:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.
  5. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
  6. Select the Conditions tab.
    1. In the Policy Workflow field, select the policy workflow created earlier in the Creating a Policy Workflow section.
    2. In the Device Role field, select DEFAULT DEVICE ROLE POLICY 1.
  7. Select the Settings tab.
    1. From the Use Certificate Authority drop-down list, select the intermediate CA.
    2. From the Use Certificate Template drop-down list, select the certificate template created earlier in the Creating a Certificate Template section.
    3. In the other settings, retain the default values.
    4. Click Update.

Configuring ACME.sh for Linux

This section describes how to configure acme.sh on a Linux host to enroll an AI agent for an SVID. You’ll need the Key ID, HMAC Key, and Server URL downloaded earlier in the Creating an ACME (Pre-authorized) Server Certificate Enrollment Token section.

To configure acme.sh for Linux, perform the following steps:

  1. Install acme.sh:
				
					curl https://get.acme.sh | sh -s email=<your-email@example.com>
  1. Register the ACME account using your EAB credentials:
				
					~/.acme.sh/acme.sh --register-account \
  --server <ACME_DIRECTORY_URL> \
  --eab-kid "<EAB_KEY_ID>" \
  --eab-hmac-key "<EAB_HMAC_KEY>" \
  -m <your-email@example.com>
  1. Issue the certificate for the device:
				
					~/.acme.sh/acme.sh --issue \
    -d <DEVICE_ID> \
    --server <ACME_DIRECTORY_URL> \
    --standalone

Deployment and Certificate Issuance

SecureW2 Admins can verify successful certificate enrollment by navigating to Data and Monitoring > Enhanced Events, where the enrolled device will display a Certificate Issued message.

More SecureW2 Documentation Explainers