--- title: How to provision certificates for internal services with... description: A step-by-step walkthrough shows how to use Teleport Workload Identity to issue short-lived X.509 certificates for mutual TLS between internal services. It... canonical: https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to provision certificates for internal services with Teleport Workload Identity | daily.dev og:description: A step-by-step walkthrough shows how to use Teleport Workload Identity to issue short-lived X.509 certificates for mutual TLS between internal services. It... og:url: https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs og:image: https://api.daily.dev/og/posts/GMDx7VeJS.png og:image:alt: How to provision certificates for internal services with Teleport Workload Identity og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to provision certificates for internal services with Teleport Workload Identity **[Teleport](https://daily.dev/sources/teleport)** · 14 min read · 0 upvotes · 0 comments ## Summary A step-by-step walkthrough shows how to use Teleport Workload Identity to issue short-lived X.509 certificates for mutual TLS between internal services. It covers setting up an internal CA via Teleport, configuring the tbot agent on GCP and AWS EC2 VMs using platform-native join methods, configuring NGINX for mTLS, testing the setup with curl, and reviewing the resulting audit log events for bot joins and SVID issuance. The certificates are SPIFFE-compatible, avoiding long-lived secrets and enabling fine-grained RBAC and auditing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I set up mutual TLS between internal services without a traditional certificate authority? Use a short-lived certificate issuance system like Teleport Workload Identity, which runs an internal CA and issues SPIFFE-compatible X.509 certificates via an agent called tbot. The agent authenticates to the cluster using platform identity (like a GCP service account or AWS IAM role) rather than long-lived secrets, then writes certificates that services like NGINX use for mTLS. _daily.dev surfaces practical mTLS setup guides for engineers hardening internal service communication._ ### What is a SPIFFE SVID and how does it relate to X.509 certificates? A Secure Verifiable Identity Document (SVID) is a standardized way to encode a workload's identity into a verifiable document, and the most common form is an X.509 certificate. Certificates compatible with SPIFFE, such as those issued by Teleport Workload Identity, can be referred to as SVIDs and interoperate with other SPIFFE-compliant tools. _Engineers evaluating workload identity standards can track SPIFFE-related developments on daily.dev._ ### How does tbot authenticate a VM to Teleport without storing a long-lived secret? The tbot agent uses a join method matched to the platform's native identity mechanism, for example the IAM role attached to an AWS EC2 instance or the service account on a GCP Compute Engine VM. Teleport verifies this platform identity during the join process instead of relying on a static API token, reducing the risk of secret exfiltration. _Teams designing secretless authentication for infrastructure can follow implementation details like this on daily.dev._ ## Similar posts on daily.dev - [AI Overload: How to Solve the Workload Identity Crisis](https://daily.dev/posts/ai-overload-how-to-solve-the-workload-identity-crisis-s0rswqshu) · Dark Reading · 1 upvotes · 0 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Workload identity federation GA: Eliminate static credentials with OIDC](https://daily.dev/posts/workload-identity-federation-ga-eliminate-static-credentials-with-oidc-ekx9iis1v) · Tailscale · 0 upvotes · 0 comments --- Tags: [#nginx](https://daily.dev/tags/nginx) [View this post on daily.dev](https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to provision certificates for internal services with Teleport Workload Identity","url":"https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs"},"datePublished":"2026-08-23T12:23:02.412Z","dateModified":"2026-08-23T12:53:45.956Z","description":"A step-by-step walkthrough shows how to use Teleport Workload Identity to issue short-lived X.509 certificates for mutual TLS between internal services. It...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"nginx","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to provision certificates for internal services with Teleport Workload Identity"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-provision-certificates-for-internal-services-with-teleport-workload-identity-gmdx7vejs#faq","mainEntity":[{"@type":"Question","name":"How do I set up mutual TLS between internal services without a traditional certificate authority?","acceptedAnswer":{"@type":"Answer","text":"Use a short-lived certificate issuance system like Teleport Workload Identity, which runs an internal CA and issues SPIFFE-compatible X.509 certificates via an agent called tbot. The agent authenticates to the cluster using platform identity (like a GCP service account or AWS IAM role) rather than long-lived secrets, then writes certificates that services like NGINX use for mTLS. daily.dev surfaces practical mTLS setup guides for engineers hardening internal service communication."}},{"@type":"Question","name":"What is a SPIFFE SVID and how does it relate to X.509 certificates?","acceptedAnswer":{"@type":"Answer","text":"A Secure Verifiable Identity Document (SVID) is a standardized way to encode a workload's identity into a verifiable document, and the most common form is an X.509 certificate. Certificates compatible with SPIFFE, such as those issued by Teleport Workload Identity, can be referred to as SVIDs and interoperate with other SPIFFE-compliant tools. Engineers evaluating workload identity standards can track SPIFFE-related developments on daily.dev."}},{"@type":"Question","name":"How does tbot authenticate a VM to Teleport without storing a long-lived secret?","acceptedAnswer":{"@type":"Answer","text":"The tbot agent uses a join method matched to the platform's native identity mechanism, for example the IAM role attached to an AWS EC2 instance or the service account on a GCP Compute Engine VM. Teleport verifies this platform identity during the join process instead of relying on a static API token, reducing the risk of secret exfiltration. Teams designing secretless authentication for infrastructure can follow implementation details like this on daily.dev."}}]} ```