AWS and Keyfactor publish X.509 PKI reference architecture for AI agent identity
Overview
AWS and Keyfactor publish a reference architecture that uses X.509 PKI to give AI agents cryptographic identities, according to an AWS Machine Learning Blog post dated October 20, 2026.
The design combines signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation checking. The authors say the Model Context Protocol (MCP) has no built-in authentication standard, and they state the pattern applies to any MCP-compatible tool server. Source code is available in a GitHub repository.
Written by AI from the articles below · updated Oct 20, 12:52 PM ET
Check the sources:
Article timeline
The articles in this story. Times are ET.
- AWS Machine Learning BlogOfficialSecuring AI agent identity with X.509 PKI on AWS and Keyfactor EJBCA
AIAWS and Keyfactor publish a reference architecture that uses X.509 PKI to give AI agents cryptographic identities. The design combines signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation checking. The authors say MCP has no built-in authentication standard, and the pattern applies to any MCP-compatible tool server. Source code is in a GitHub repository.
Heat Trend
Not enough continuous observations to show a trend yet.