Abstract: Operations of a certificate bundle distribution service may include: detecting a trigger condition to distribute a certificate bundle that includes a set of certificate authority certificates; determining, for each of a plurality of network entities associated with a computer network, a fault domain representing at least one single point of failure; partitioning the plurality of network entities into a plurality of certificate distribution groups, based on a set of partitioning criteria that includes a fault domain of each particular network entity, in which each particular certificate distribution group includes a particular subset of network entities, and the particular subset of network entities are associated with a particular fault domain; selecting a particular certificate distribution group, of the plurality of certificate distribution groups, for distribution of the certificate bundle; and transmitting the certificate bundle to the particular subset of network entities in the particular certificate di

Abstract: Techniques for provisioning a cloud resource instance associated with a virtual cloud network may include detecting a certificate bundle-retrieval trigger during a provisioning process for the cloud resource instance, and responsive to detecting the certificate bundle-retrieval trigger, sending, to an agent executing on a network interface linked to the cloud resource instance, a request for a certificate bundle for the cloud resource instance. Techniques may further include receiving the certificate bundle from the network interface. The certificate bundle may include a set of certificate authority (CA) certificates. Techniques may further include installing the certificate bundle in a storage medium associated with the cloud resource instance. Installing the certificate bundle may represent an operation of the provisioning process.