---
title: "Certificate Hierarchy"
description: "
"
url: https://instituteofprovenance.org/docs/certificate-hierarchy
source: Institute of Provenance
---
# Certificate Hierarchy

The Institute of Provenance operates a hierarchical certificate system purpose-built for content attribution. The hierarchy follows the same structural model as TLS/PKI but is designed for content signing rather than transport security, with short-lived leaf certificates and an offline root.

## Three-Tier Model

```
Institute of Provenance Root CA
  └── Certified Orbital Intermediate
        └── Content Signing Leaf Certificate
```

**Root CA** — Self-signed Ed25519 certificate held offline by the Institute. Never connected to a network. 10-year validity (2025–2035). Used only to sign intermediate certificates during formal key ceremonies.

**Intermediate Certificates** — Issued to Certified Orbital operators. Multi-year validity. Authorized to issue leaf certificates and manage certificate state within their organization's scope.

**Leaf Certificates** — Short-lived (hours to one day) content signing certificates issued on demand by Certified Orbitals. Used to sign individual content artifacts.

## Trust Model

The trust model is rooted in a single well-known constant: the Root CA public key. Any party that knows this public key can verify any XION artifact by tracing the certificate chain from the leaf back to the root.

This is structurally identical to how browsers verify TLS certificates — a known set of root CAs anchors trust, and the chain is validated mathematically without trusting any intermediate server.

## Why Short-Lived Leaves

Traditional PKI uses certificates valid for 1–2 years. This creates a large window of exposure if a key is compromised, requiring complex revocation infrastructure (CRLs, OCSP) that is frequently unreliable.

Short-lived leaf certificates (hours to one day) reduce the blast radius of key compromise to the certificate's validity period. Even in a worst-case scenario where a signing key is stolen, the damage is bounded by the certificate's short lifetime.

Revocation remains available via Sparse Merkle Trees for cases where immediate invalidation is needed, but short lifetimes are the primary defense.

## Certificate Format

All certificates in the hierarchy use X.509 v3 format with Ed25519 keys. The choice of X.509 provides compatibility with existing PKI tooling and libraries while Ed25519 provides modern elliptic curve security with compact keys and signatures.

See the sub-pages for detailed specifications of each certificate tier:

- [Root Certificate Authority](/docs/root-ca)
- [Intermediate Certificates](/docs/intermediate-certificates)
- [Leaf Certificates](/docs/leaf-certificates)