Demo: Root Signing Key Ceremony

Overview

Generate an offline root key on an air-gapped workstation, issue its self-signed certificate, and export the public key. The crypto officer and witness attest to the ceremony.

Preparation Checklist

Prerequisites

The air-gapped workstation is powered on with all network interfaces physically disconnected.
Both participants have verified each other's identity against photo ID.

Environment Verification

Step	Action	Role
1	Confirm and witness the air gap before any key material exists.	CO

Key Generation

Step	Action	Role
2	Generate the RSA-4096 root keypair.	CO
3	Create a certificate signing request for the root key.	CO
4	Issue the self-signed root certificate, valid for 20 years.	CO
5	Export the public key for distribution as the trust anchor.	CO

Witness Attestation

Step	Action	Role
6	Attest: "I witnessed the generation of the root signing key and the issuance of its certificate."	Wi
7	Attest: "I generated the root signing key, issued its self-signed certificate, and exported the public key."	CO

Transcript Fingerprint

At the end of the ceremony, the transcript fingerprint is displayed. Copy at least the first line (32 characters, shown in bold) into the field below before closing the terminal, while all participants are still present.

sha256

Signatures

By signing below, each participant attests to the accuracy and completeness of this ceremony.

Crypto Officer

Name: Alice Rivera

Signature

Date

Witness

Name: Bob Tanaka