"Which CA signs this?" is a question that, in too many PKIs, has several answers depending on which config file you read. goca allows exactly one place to answer it: the template.
Which CA issues under a template is declared on the template itself — issuerRef, generation-agnostic, so rollover never touches templates. Protocol endpoints bind a template; the CA follows from it. One binding, maintained in one place; the issued certificate then records the concrete CA generation and template version, so the record is always exact even though the binding is logical.
The console asks the question at the top of the editor — an Issuing CA dropdown that shows and sets the document's own issuerRef. Three states it reports rather than papering over:
- Not bound — no
issuerRef, so the template cannot issue. The shipped library starts here by design. - Unknown or retired CA — the binding stays visible and selected so you can correct it; it is not silently dropped.
- List or label binding —
issuerRefas a list, or selection by label. A single dropdown cannot express either, so it disables itself and points at the document instead of flattening what you wrote.
Now I can say where a certificate's issuing CA is decided — in exactly one place.