CAs Are Documents — Operator training

Ask an old-school PKI where a CA "is" and you get a directory path and a key file. Ask goca and you get a document. A CA is a logical authority (root-g1, ica-tls) whose subject, key algorithm, custody mode, validity and rollover policy live in a versioned spec document.

Creation reflects that: the console's create form is a two-pane form + YAML/JSON editor over the POST /v1/cas request body itself. What the code pane shows is exactly what Save posts, so a CA can be authored as code — paste a document — or field by field, and the two stay in sync.

The key is deliberately not in the picture: key generation is an intent executed by the key service in the selected custody. The management process never receives a CA private key — it asks for one to exist, and gets back a record that it does.

Metaphor: a land title. The document describes the property and proves ownership; it is not the land.

Where it breaks: land exists before its title. Here the document comes first — the key is minted because the document says so, in the custody it names.

Now I can describe a CA without pointing at a key file.