> Markdown version of https://docs.laavat.io/gui/clients/registration/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# Client Registration

## Overview

Clients are **applications or services** that interact with the LAAVAT Platform API to perform cryptographic operations such as signing, encryption, and certificate issuance. Before a client can use the platform, it must be **registered** with appropriate credentials and linked to one or more products.

The Client Registration page in the GUI provides tools to create, view, and manage client registrations. Each registration associates a client identity (defined by a certificate or public key) with a specific client type and product.

> **Tip: Planning client registrations**
> Before registering a client, ensure that the target product has been created and that the appropriate features and PKI configurations are in place. A client registration links to a product by its UUID, so the product must exist first.

---

## Client Types

Each client registration must specify a **client type** that determines which operations the client is authorized to perform. The available client types are:

| Client Type | Description | Typical Use Case |
|-------------|-------------|-----------------|
| **Security Engineer** | Retrieves the product's exportable AES key material and the keys of its `ExportableToken` operations. Each key is wrapped with the client's registered EC public key so only the matching private key can recover it. | Security or operations engineers exporting device-decryption keys for offline use. |
| **CB Tester** | Reserved for future use. | -- |
| **Production PC** | Used to retrieve product secrets such as the SRK hash, SRK table and product-specific encryption IV used on the production line. | Automated build and release pipelines in manufacturing or CI/CD environments. |
| **Issue Device Certificate CA** | Authority to issue device certificates at the CA level. | Services managing device certificate issuance for a fleet of devices. |
| **Issue Device Certificate** | Permission to request individual device certificates. | Individual devices or device provisioning services requesting their own certificates. |
| **EST Issue Device Certificate CA** | Authority to issue device certificates through the EST protocol at the CA level. | EST-integrated services managing automated device enrollment. |
| **EST Issue Device Certificate** | Permission to request device certificates through the EST protocol. | Devices enrolling for certificates via EST endpoints. |
| **Issue Certificate CA** | Authority to issue certificates other than device certificates at the CA level: any certificate issued by the registered CA authenticates. | Services issuing server, client or signing certificates for a fleet through the REST API. |
| **Issue Certificate** | Permission to request certificates other than device certificates with the registered end-entity certificate. | A single service or workstation requesting its own certificates through the REST API. |
| **EST Issue Certificate CA** | Authority to issue certificates other than device certificates through the EST protocol at the CA level. | EST-integrated services enrolling non-device certificates for many endpoints. |
| **EST Issue Certificate** | Permission to request certificates other than device certificates through the EST protocol with the registered end-entity certificate. | A single endpoint enrolling its own non-device certificates via EST. |

> **Warning: Choosing the correct client type**
> The client type cannot be changed after registration. If you need to modify a client's type, you must delete the existing registration and create a new one. Choose carefully based on the operations the client needs to perform.

---

## Certificates and Keys

Client identity in the LAAVAT Platform is established through cryptographic credentials. Each client registration requires one of the following:

### X.509 Certificates

Provide a **PEM-encoded X.509 certificate** to identify the client. The platform uses the certificate's public key to authenticate API requests signed by the client.

```text
-----BEGIN CERTIFICATE-----
MIIBxTCCAWugAwIBAgIUQ3mK...
...
-----END CERTIFICATE-----
```

> **Tip: Certificate requirements**
> - The certificate must be in **PEM format** (Base64-encoded DER wrapped in `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` headers).
> - Self-signed certificates are accepted; the platform does not validate the certificate chain for client authentication.
> - Ensure the certificate has not expired. Expired certificates will be rejected during API authentication.

### Public Keys

Alternatively, provide a **PEM-encoded public key** if you do not want to use a full X.509 certificate.

```text
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQE...
...
-----END PUBLIC KEY-----
```

> **Tip: Key type per client type**
> **Security Engineer** clients must register an **EC P-256** public key: the wrapped-keys flow performs ECDH against it.
> **Production PC** clients must register a public key too, **RSA or EC**; the product secrets are encrypted to whichever
> was registered. The certificate-based types authenticate with their certificate and need no separate key. A registration
> with a missing or wrong key type is refused with a message naming the requirement.

### Product Association

Every client registration must be linked to a **product** via its **Product ID (UUID)**. This association determines which product's resources (CAs, features, signing keys) the client can access.

| Field | Format | Description |
|-------|--------|-------------|
| **Product ID** | UUID (e.g., `550e8400-e29b-41d4-a716-446655440000`) | The unique identifier of the product this client is authorized to access. |

> **Warning: One product per registration**
> A single client registration is associated with exactly one product. If a client application needs access to multiple products, create separate registrations for each product.

---

## Registration Workflow

### Creating a New Client Registration

1. Navigate to **Clients > Registration**.
2. Click **Add Client** (or the equivalent action button).
3. Fill in the required fields:
    - **Client Name** -- A human-readable name for the client.
    - **Client Type** -- Select from the available client types.
    - **Product ID** -- Enter the UUID of the target product.
    - **Certificate or Public Key** -- Paste the PEM-encoded certificate or public key.
4. Click **Save** to create the registration.

### Viewing Existing Registrations

The registration list displays all currently registered clients with the following information:

| Column | Description |
|--------|-------------|
| **Client Name** | The display name of the registered client. |
| **Client Type** | The type of operations the client is authorized to perform. |
| **Product** | The product the client is associated with. |
| **Created** | The date and time the registration was created. |

### Deleting a Client Registration

To remove a Client Registration:

1. Create a change request for client deletion. See [Client Change Requests](https://docs.laavat.io/gui/clients/change-requests/).
2. The change request is approved by relevant party.
3. Locate the client in the Client Registrations list view. The Client is marked as **ToBeDeleted**.
4. Click the **Delete** action.
5. Confirm the deletion in the dialog.

> **Warning: Deletion is permanent**
> Deleting a client registration immediately revokes the client's access to the platform API. Any in-flight operations by the client may fail. Ensure that the client is no longer in active use before deleting its registration.

---

## Troubleshooting

| Issue | Possible Cause | Resolution |
|-------|---------------|------------|
| Client cannot authenticate with the API | Certificate has expired or does not match the registered credential | Re-register the client with a valid certificate or public key |
| Product ID is rejected during registration | The UUID does not correspond to an existing product | Verify the product exists and copy the correct UUID from the Products page |
| Client receives "unauthorized" for an operation | The client type does not include the required permission | Delete the registration and re-create it with the correct client type |