<commit_before>---
title: Using Instance Identity Credentials
owner: Diego
---



This topic describes enabling the Instance Identity system for your Cloud Foundry (CF) deployment.  The Instance Identity system provides each app instance with a unique PEM-encoded [X.509](https://tools.ietf.org/html/rfc5280) certificate and [PKCS#1](https://tools.ietf.org/html/rfc3447) RSA private key pair that encodes its identity in the CF deployment.

The environment variable `CF_INSTANCE_CERT` contains the absolute path to the certificate. The environment variable `CF_INSTANCE_KEY` contains the absolute path to the key file. The provided certificate has the following properties:

- The `Common Name` property is set to the instance GUID for the given app instance.
- The certificate contains an IP SAN set to the container IP address for the given app instance.
- The certificate contains a DNS SAN set to the instance GUID for the given app instance.
- The `Organizational Unit` property in the certificate's Subject Distinguished Name contains the values `organization:ORG-GUID`, `space:SPACE-GUID`, and `app:APP-GUID`. The `ORG-GUID`, `SPACE-GUID`, and `APP-GUID` are set to the GUIDs for the organization, space, and app as assigned by Cloud Controller.

By default, the certificate is valid for 24 hours after the container is created. The CF platform operator can decrease this duration to as little as 1 hour by setting the `diego.executor.instance_identity_validity_period_in_hours` BOSH property.

The Diego cell rep supplies a new certificate and private key pair to the app instance before the end of the validity period. The new pair of files replaces the existing pair at the same path locations, with each file replaced atomically. 

* If the validity period exceeds 4 hours, the pair regenerates between 1 hour and 20 minutes before the end of the validity period. 
* If the validity period is less than or equal to 4 hours, the pair regenerates between 1/4 and 1/12 of the time to the end of the period.


For more information about enabling and configuring the Instance Identity system in Cloud Foundry, see [Enabling Instance Identity](https://docs.cloudfoundry.org/adminguide/instance-identity.html).
<commit_msg>Replace product name with variable<commit_after>---
title: Using Instance Identity Credentials
owner: Diego
---



This topic describes enabling the Instance Identity system for your <%= vars.app_runtime_first %> deployment.
The Instance Identity system provides each app instance with a unique PEM-encoded [X.509](https://tools.ietf.org/html/rfc5280) certificate and [PKCS#1](https://tools.ietf.org/html/rfc3447) RSA private key pair that encodes its identity in the CF deployment.

The environment variable `CF_INSTANCE_CERT` contains the absolute path to the certificate. The environment variable `CF_INSTANCE_KEY` contains the absolute path to the key file. The provided certificate has the following properties:

- The `Common Name` property is set to the instance GUID for the given app instance.
- The certificate contains an IP SAN set to the container IP address for the given app instance.
- The certificate contains a DNS SAN set to the instance GUID for the given app instance.
- The `Organizational Unit` property in the certificate's Subject Distinguished Name contains the values `organization:ORG-GUID`, `space:SPACE-GUID`, and `app:APP-GUID`. The `ORG-GUID`, `SPACE-GUID`, and `APP-GUID` are set to the GUIDs for the organization, space, and app as assigned by Cloud Controller.

By default, the certificate is valid for 24 hours after the container is created. The CF platform operator can decrease this duration to as little as 1 hour by setting the `diego.executor.instance_identity_validity_period_in_hours` BOSH property.

The Diego cell rep supplies a new certificate and private key pair to the app instance before the end of the validity period. The new pair of files replaces the existing pair at the same path locations, with each file replaced atomically. 

* If the validity period exceeds 4 hours, the pair regenerates between 1 hour and 20 minutes before the end of the validity period. 
* If the validity period is less than or equal to 4 hours, the pair regenerates between 1/4 and 1/12 of the time to the end of the period.


For more information about enabling and configuring the Instance Identity system in Cloud Foundry, see [Enabling Instance Identity](https://docs.cloudfoundry.org/adminguide/instance-identity.html).

{'fraction_non_alphanumeric': 0.0548494983277592, 'fraction_numerical': 0.011148272017837236, 'mean_word_length': 4.729246487867178, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3735620', 'n_tokens_mistral': 1151, 'n_tokens_neox': 1103, 'n_words': 624}