ThingMint — certificate authority boundary

ThingMint is TrustMint’s certificate and license authority. It signs and revokes device certificates and publishes the public trust material used by provisioning and verification flows.

What console users need to know

ThingMint is not a tenant console application and does not appear in the account product switcher. Tenant users do not request certificate-authority keys or handle private CA material. Certificate work happens as part of authorized lifecycle operations in ThingMake, while device and certificate status is shown in the applications that own those workflows.

Platform certificate governance is restricted to platform administrators in Arsenal on the admin console. It is not available to tenant users.

Trust-material safety

• Private CA keys remain in the managed KMS boundary.

• Device private keys are generated or held by the device-side flow; the console never displays them.

• Certificate issuance, revocation, and authority changes are audited.

• External integrators should use the documented public API or DDI contract, not private browser routes.

For protocol and integration details, use the TrustMint developer documentation.