Device Management
Every mobile signer in The Vault is bound to a specific physical device via an X.509 device certificate. This binding ensures that the key share stored on a device cannot be extracted and used elsewhere. Device management covers certificate issuance, approval, renewal, and revocation.
How Device Binding Works
When a mobile device is enrolled (see Mobile App Setup):
- The mobile app generates a device identity key pair. The private key is stored encrypted at rest on the device and is never transmitted off-device.
- The app generates a Certificate Signing Request (CSR) containing the device public key and a device identifier.
- The CSR is submitted to the Vault via the enrollment API.
- The Vault signs the CSR and issues an X.509 device certificate (with a configured validity period).
- The certificate is stored on the device. The key share (when subsequently generated) is wrapped with the device certificate’s public key and stored encrypted.
The key share is stored encrypted, with its encryption key held in the device’s OS secure storage. A copy of the encrypted share file is not usable on its own — decrypting it also requires the encryption key held in that device’s secure storage.
Viewing Devices
Navigate to Settings → Mobile devices to see all enrolled devices, with columns for name, owner, model, OS version, app version, status, created, and last active. A device moves through these statuses:
| Status | Meaning |
|---|---|
| Pending | Enrollment started; awaiting approval |
| Pending certificate | Approved; certificate being issued |
| Active | Certificate issued; can participate in signing |
| Rejected | Enrollment denied |
| Blocked | Logged out and excluded from signing |
Approving a Device Enrollment
When a new device completes the enrollment pairing, it appears with status Pending. It must be approved before it can participate in signing.
Review the Device
In Settings → Mobile devices, open the pending device and verify:
- The device name and owner match what you expect (confirm out-of-band with the user).
- The certificate fingerprint shown in the dashboard matches what the mobile app displays.
Approve or Reject
Approve (pair) the device to begin certificate issuance, or Reject to deny enrollment. Once the certificate is issued the device becomes Active.
Blocking a Device
If a device is lost, stolen, or a user leaves the organisation, block it immediately from Settings → Mobile devices in the dashboard: select the device and choose Block. (To decommission a device permanently, use Remove.)
Blocking is immediate and does three things:
- Sets the device to BLOCKED and excludes it from the eligible signer set.
- Logs the device out — its sessions are revoked, so it can no longer authenticate to the Vault API or receive signing requests.
- Revokes the device’s certificate at the internal CA.
As a result the blocked device can no longer receive signing requests or submit partial signatures.
After blocking a device, initiate a key share re-enrollment to restore the configured signing threshold. Until re-enrollment is complete, the number of active signers may be insufficient to meet the threshold. Re-enrollment should be completed promptly.
Key Share Re-enrollment
When a mobile signer device is replaced or blocked, a new device must receive a new key share via re-enrollment:
Enroll the Replacement Device
Follow the Mobile App Setup steps 1–4 to enroll the new device and get it to Pending Approval status.
Initiate Recovery to the Replacement Device
From the key’s actions under Wallets → Keys, start a share recovery to the newly enrolled device (the operation that re-issues a party’s key share to a replacement device).
Complete the Ceremony
A re-enrollment ceremony requires the two server signers and the remaining active mobile signer to cooperate to issue a new key share to the replacement device. All participants receive a notification.
The new device’s app displays a prompt: “Accept key share from existing signers?”. The user taps Accept and authenticates with their app PIN.
Confirm Completion
Once the ceremony succeeds, the new device is marked as an active signer. The blocked device is permanently excluded from future signing sessions.
Certificate Renewal
Device certificates have a configured validity period and are renewed before they expire. The dashboard flags a certificate as expired on the device list, and certificate management is available from the device’s Certificates action. Renewal reuses the same secure-hardware key:
- A new CSR is generated using the device’s existing hardware key.
- The CSR is submitted to the Vault and a new certificate is issued.
- The old certificate is retired.
The key share is re-wrapped with the new certificate during renewal — no DKG re-ceremony is required.