checkId: check.crypto.register-provider plugin: stellaops.doctor.crypto severity: info tags: [crypto, runbook, catalog]

Register a New Crypto Provider

Runbook — for Stella Ops platform administrators adding a new well-known crypto provider (eIDAS QTSP, HSM PKCS#11, additional GOST/SM vendors, and similar) to the provider catalog.

The catalog at platform.crypto_provider_catalog is the source of truth for which providers the Platform admin UI surfaces and the /api/v1/admin/crypto-providers/health probe iterates over.

Steps

  1. Deploy the plugin DLL. The ICryptoProvider implementation must ship as code under src/__Libraries/StellaOps.Cryptography.Plugin.* (or src/Cryptography/StellaOps.Cryptography.Plugin.*) and be present in the service container that will run the catalog. Catalog rows do not load DLLs from the database — that boundary is non-negotiable for supply-chain integrity.

  2. Register the catalog row. Either:

    a. Admin endpoint (preferred) — POST /api/v1/admin/crypto-providers/catalog with the crypto-admin scope:

    POST /api/v1/admin/crypto-providers/catalog
Content-Type: application/json

{
  "providerId": "eidas-qtsp",
  "displayName": "eIDAS QTSP",
  "healthEndpoint": "http://eidas-qtsp.local/health",
  "advertisedAlgorithms": ["ES256"],
  "supportedProfiles": ["eidas"],
  "isProductionReady": true,
  "pluginProviderId": "eu.eidas.qtsp"
}

    b. Direct SQL (operator escape hatch):

    INSERT INTO platform.crypto_provider_catalog
  (provider_id, display_name, health_endpoint, advertised_algorithms,
   supported_profiles, is_production_ready, plugin_provider_id, version)
VALUES
  ('eidas-qtsp', 'eIDAS QTSP', 'http://eidas-qtsp.local/health',
   ARRAY['ES256'], ARRAY['eidas'], true, 'eu.eidas.qtsp', '1');

  3. Restart the relevant services so the in-process provider list refreshes. The catalog is read on each /health probe, but cached registries inside each service may need a restart to pick up the new plugin.

  4. Verify health. Hit GET /api/v1/admin/crypto-providers/health and confirm the new provider appears with status running (or unreachable until step 3 deploys the DLL).

Removal

DELETE /api/v1/admin/crypto-providers/catalog/{providerId} is refused with 409 Conflict if any active row in platform.tenant_crypto_preferences references the provider id. Set the preference inactive (or delete it) first.

Notes