Nuvy will provide the client with the public CA certificate:

This certificate is used only for validation and does not contain sensitive information. The client should store it securely for auditing and troubleshooting.

In the client's environment:

Generate a Certificate Signing Request (CSR):

Send the following file to Nuvy through a secure channel previously agreed upon:

Nuvy will sign the CSR and generate the client certificate with:

• ExtendedKeyUsage = clientAuth
• KeyUsage = digitalSignature, keyEncipherment

The client will receive:

Before using in production, the client MUST validate:

Expected result:

Example using curl:

Code examples for common platforms:

Java

Configure KeyStore + TrustStore

Node.js

Python

Nuvy can provide additional examples on demand.

When to rotate:

• Key compromise
• Certificate expiration
• Environment change

Process:

1. Generate new key pair
2. Generate new CSR
3. New signature by Nuvy
4. Client update

• Protect *.key files with restricted permissions (chmod 600)
• Never version-control private keys
• Plan periodic certificate rotation
• Monitor for ClientCertUntrusted errors in your logs

Common error: ClientCertUntrusted

• Certificate not signed by the correct CA
• Incorrect CA in TrustStore
• Expired certificate
• HTTP/2 usage (try forcing HTTP/1.1)

Quick handshake test:

Expected result:

Some clients already use a certificate from another partner (e.g., for migration). In this case, the client sends Nuvy their client certificate and the full certificate chain (leaf + intermediate/root CAs).

Nuvy will then:

1. Extract the CA certificates from the chain
2. Configure the infrastructure to trust the client's CA
3. The client keeps using the same certificate and private key to connect to the Nuvy API