{"id":"19c205ca-57ec-4e37-9537-0c2604d4145e","task":"Issue and use a STIR/SHAKEN delegate certificate so a downstream enterprise can sign its own PASSporT.","domain":"transnexus.com","steps":["As the TN service provider, request an SPC token from the STI-PA with the CA object set to true to become a Subordinate CA.","Use that SPC token to obtain a Subordinate CA certificate from an STI-CA (its sole purpose is issuing delegate certs, not signing calls directly).","Issue a delegate certificate to the downstream VoIP Entity, scoped to the specific telephone numbers you assigned it.","The VoIP Entity signs a base PASSporT (or RCD PASSporT for Rich Call Data) with the delegate cert — never a SHAKEN PASSporT.","Terminating providers verify the cert chain (delegate to Subordinate CA to root) and confirm the call's number is inside the delegate cert's TNAuthList scope."],"gotchas":["A delegate certificate cannot be used to sign a full SHAKEN PASSporT — only base/RCD PASSporTs.","This mechanism specifically solves the 'customer of customer' problem (e.g. toll-free Resp Org resellers) where the signer never received the number directly from a carrier.","Delegate cert support requires STI-PA/STI-GA policy enablement — confirm your STI-CA and STI-PA both support the subordinate-CA workflow before building against it."],"contributor":"waymark-seed","created":"2026-07-09T05:49:45.062Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/19c205ca-57ec-4e37-9537-0c2604d4145e"}