So for example. We have a root ca for everything. Then created an intermediate for the infrastructure (posgtres, etc). We also created an intermediate just the

So for example. We have a root ca for everything. Then created an intermediate for the infrastructure (posgtres, etc). We also created an intermediate just the API, from which we issue client certificates for API access. This is just for securing the connection to allowed users. Once connected via a client cert, they still have to do the proper auth with OAUTH, etc on top of that. Should the intermediate or client certs get compromised, we reissue an API intermediate, and new client certs. All of course, on top of OAUTH revoking, etc.