Banyan Cluster and Private PKI
- Updated on May 13, 2023
A Cluster is a logical grouping of Banyan Access Tiers that are managed together for a given Organization. A Banyan Cluster includes a Private PKI (Public Key Infrastructure) to distribute cryptographic identities (X.509 Certificates) to clients and services in your organization.
Public Key Infrastructure (PKI)
As in the diagram below, the Banyan component called Shield manages a private PKI (Public Key Infrastructure), also known as an Internal CA (Certificate Authority), to distribute cryptographic identities (typically X.509 Certificates) to clients and services in your organization.
Shield CA distributes certificates
Netagents running on Linux Hosts talk directly to Shield to receive certificates on behalf of workloads and services. The Banyan App (or other clients) communicate with Shield via the Command Center’s RESTful APIs.
Banyan issues server certificates for hosted services and SSH servers.
|Cert Nickname||Format||Subject CN / KeyID||Validity Period||Server Name and Purpose|
||1 year (auto-rotated every 24 hours)||Banyan Service, to secure hosted services|
||1 year||Linux Host, for SSH authentication|
Banyan also issues various types of client certificates for use in different client authentication scenarios.
|Cert Nickname||Format||Subject CN / KeyID||Validity Period||Client Name and Purpose|
||1 year (revoke via OCSP)||Banyan Desktop App, for device registration|
||24 hours (adjustable)||Banyan Desktop App, for access to TCP Services|
||1 year (auto-rotated every 24 hours)||Linux Workloads, for service-to-service authNZ|
||24 hours (adjustable)||Banyan Desktop App, for SSH authentication|
Banyan “decorates” the certificates issued by Shield with client and server information.
For X.509 certificates, we use X.509 Subject Alternative Name - SAN, an extension to X.509 that allows various values to be associated with a certificate using a subjectAltName field. In server X.509 certs, the SAN field
DNS Name contains the Banyan ServiceName. In client X.509 certs, the SAN field
DNS Name contains the client’s Roles.
For SSH certificates, Banyan used the
Principals field. In client SSH cert, the
Principals field contains the client’s Roles.
Can’t find what you’re looking for?
We’re happy to help. Contact our team.