The AWS Machine Learning Blog now describes a reference architecture that couples Keyfactor EJBCA with native AWS services to provide AI agents with X.509‑based cryptographic identity. Replacing simple API keys or OAuth token chains, the design introduces signed request envelopes, delegation assertions, audience‑scoped tokens, and OCSP revocation to meet zero‑trust requirements in multi‑agent workflows.
Why AI agent PKI Matters
Multi‑agent frameworks such as the Model Context Protocol (MCP) allow LLM‑powered agents to invoke external tools, but MCP itself does not define authentication. Without a strong identity layer, any component could impersonate an agent, replay credentials, or call tools without authorization. Traditional approaches—shared API keys or passing OAuth tokens—cannot guarantee that the request originated from the intended agent or that the agent is acting on behalf of an authorized user.
AI agent PKI Architecture Overview
The reference design introduces three distinct authentication layers:
- User → System: OAuth combined with an X.509 certificate and a delegation‑minting step validates the user and binds credentials.
- Agent → Agent: Each call carries a signed envelope containing proof‑of‑possession, a nonce, and a timestamp, ensuring caller identity and freshness.
- Agent → Tool Server (MCP): A scoped token, the signed envelope, and a delegation assertion together prove the full authorization chain and trigger OCSP validation.
Keyfactor EJBCA provides the certificate issuance, lifecycle management, and OCSP services. The architecture runs EJBCA in a high‑availability deployment on Amazon EC2, accessed via its REST API for automated enrollment. Amazon Bedrock supplies LLM inference, while the AWS Strands Agents SDK integrates the signed‑envelope logic into agent code.
Implementation Considerations
Practitioners should focus on four concrete mechanisms:
- Signed request envelopes: Agents must generate a payload that includes a cryptographic signature, a nonce, and a timestamp. The receiving side verifies the signature against the agent’s X.509 public key.
- Delegation assertions: After user authentication, a short‑lived assertion is minted that authorizes an agent without exposing the user’s credentials.
- Audience‑scoped tokens (RFC 8693): Tokens are limited to a specific MCP tool server, reducing exposure if a token is leaked.
- OCSP revocation checking: Every request triggers an OCSP query to EJBCA, ensuring that revoked or expired certificates are rejected immediately.
Automation is achieved through EJBCA’s REST endpoints, which can be called from CI/CD pipelines or Lambda functions to provision and rotate certificates. The SDK already includes helper functions for envelope creation and verification, minimizing custom code.
Operational Impact
Adopting this PKI model introduces new operational responsibilities:
- Certificate lifecycle management – short‑lived certificates reduce risk but require reliable automation for enrollment and renewal.
- OCSP performance – frequent revocation checks add latency; caching strategies should be evaluated against security requirements.
- Monitoring – audit logs from EJBCA, Bedrock, and the SDK should be aggregated to detect abnormal enrollment or revocation patterns.
- High‑availability – EJBCA must be deployed in a redundant configuration to avoid a single point of failure for identity issuance.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Engineers building multi‑agent systems should assess whether their current token‑sharing approach meets zero‑trust goals. If not, evaluate integrating an X.509 PKI using Keyfactor EJBCA and the outlined three‑layer model. Start by automating certificate enrollment for a single agent, validate signed envelopes end‑to‑end, and measure OCSP latency. From there, expand delegation assertions and scoped tokens to cover the full MCP tool chain, and put monitoring in place for certificate revocation events. This incremental path provides concrete proof of identity while preserving the flexibility of existing AWS services.
