[Bugs5382]

What and why

The six pages under docs/use-cases/ were stubs. This writes them for an operator who has never seen CryptOS, and keeps each one honest about the alpha: a Works today callout for what the code does now and a Planned callout for what it doesn't.

• Overview: how a certificate gets out of a node today (issue by CSR through cryptosctl ca issue-leaf or the Fleet Manager, plus CRL and OCSP), a table of every enrolment protocol and its state, and the subject-key rule (ECDSA P-384 or RSA 3072+).
• Internal TLS and mTLS: server and client profiles, then issuing, checking, revoking and renewing by CSR, with expected output in callouts.
• Kubernetes workloads: what works by CSR today, how cert-manager will fit once ACME is on (http-01 only, EAB, TLS front end, key size), and signing a cluster intermediate with ca sign-subordinate.
• Devices and IoT: issue by CSR today, what the EST server does once it can be switched on, and SCEP as planned (cryptos#185).
• Code signing: a Code Signing EKU profile and the issue-by-CSR steps; RFC 3161 timestamps and CI self-enrolment are planned.
• Air-gapped Root CA: the two-tier flow that works today, tpm versus software key modes and what each means for backup, revocation with an offline Root, and Root Mode as planned.

The protocol states come from the code on cryptos main and the open issues CryptOS-PKI/cryptos-node#110, #112, #113 and #185. One thing the pages call out plainly: the ACME and EST servers are in the node code, but the MachineConfig message used by config apply, the maintenance install and the Fleet Manager has no acme or est field, so an apply keeps an existing block but can't add one. There is no supported way to switch either on in this alpha.

Titles, emoji and sidebar order are unchanged. No page needed OS tabs: the only commands are openssl and cryptosctl, and each page that runs cryptosctl says once that it is Linux and macOS only for now (CryptOS-PKI/cryptos-node#275). Links to the VMCA, AD, ACME, EST, profiles and issued-certificates guides point at the cryptos repo docs rather than repeating them.

Part of CryptOS-PKI/cryptos-node#166. Targets the docs/stub-pages parent branch.

Closes #25

Verification

• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• npm run build on this branch: success, with no broken-link or broken-anchor warnings.
• Checked the built HTML for each page: every ::: callout rendered as an admonition, none left as literal text.
• Every command, flag, config key and error message on the pages was checked against cryptos main (cmd/cryptosctl, internal/config, internal/node/signer.go, internal/ca/profile.go, internal/init), the api protos and the web protocol page.
• Scanned the pages against the forbidden-text list.

[Bugs5382]

Commit 720c38e updates the pages that said an RSA CA key can't be held in the TPM. It depends on CryptOS-PKI/cryptos-node#282, which adds TPM-held RSA-3072 and RSA-4096 CA keys and the FailedPrecondition refusal on TPMs without the size. Merge the two together.

[Bugs5382]

Added ec537ec for CryptOS-PKI/cryptos-node#286: the overview, internal-tls, devices-iot and kubernetes pages now say ACME and EST can be switched on in the machine config on an intermediate or issuing node, with a reboot in a maintenance window, and that a Root refuses both. It depends on CryptOS-PKI/cryptos-node#286 and should merge with it.

[Bugs5382]

Added 78ea650: an info callout on the Kubernetes page saying the cert-manager ACME path is tested in CI with kind. It depends on CryptOS-PKI/cryptos-node#294 and should merge after it.

[Bugs5382]

Closing summary: writes the six Use Cases pages (overview with the enrolment protocol table and the subject-key rule, internal TLS and mTLS, Kubernetes, devices and IoT, code signing and the air-gapped Root), each with a Works today callout for what the alpha does and a Planned callout for what it doesn't. Rebased onto docs/stub-pages (now level with main, including the theme, the VMCA pages and the install pages) with every commit signed off; npm run build passes with no broken links. Merged with a merge commit so each signed-off commit reaches the parent PR's DCO check intact.