Device credentials
Device access
Enroll a device and manage its lab certificates. Sign in with your lab identity to approve a request or inspect your existing devices.
Start on the device
The native client creates a private key locally and displays an approval code and certificate request fingerprint. It never uploads the private key.
lab-enroll enroll --portal https://enroll.teskeslab.org --name workstation --state-dir ~/.local/share/teskeslab/device-identityChoose a device name and a private state directory outside source checkouts. Open the verification link printed by the client, check the fingerprint, and approve only a request you started.
Access control
Members can inspect and revoke their own device credentials. Administrators can manage owners and all recorded devices. Disabling an owner blocks local PKI access and starts revocation of all recorded certificates. Removing an identity-provider group does not automatically revoke existing certificates.