diff --git a/joinservice/joinproto/join.pb.go b/joinservice/joinproto/join.pb.go
index c197bd6ca..0777da3aa 100644
--- a/joinservice/joinproto/join.pb.go
+++ b/joinservice/joinproto/join.pb.go
@@ -8,15 +8,16 @@ package joinproto
 
 import (
 	context "context"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	components "github.com/edgelesssys/constellation/v2/internal/versions/components"
 	grpc "google.golang.org/grpc"
 	codes "google.golang.org/grpc/codes"
 	status "google.golang.org/grpc/status"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
 )
 
 const (
@@ -98,8 +99,7 @@ type IssueJoinTicketResponse struct {
 	ControlPlaneFiles        []*ControlPlaneCertOrKey `protobuf:"bytes,8,rep,name=control_plane_files,json=controlPlaneFiles,proto3" json:"control_plane_files,omitempty"`
 	KubernetesVersion        string                   `protobuf:"bytes,9,opt,name=kubernetes_version,json=kubernetesVersion,proto3" json:"kubernetes_version,omitempty"`
 	KubernetesComponents     []*components.Component  `protobuf:"bytes,10,rep,name=kubernetes_components,json=kubernetesComponents,proto3" json:"kubernetes_components,omitempty"`
-	unknownFields            protoimpl.UnknownFields
-	sizeCache                protoimpl.SizeCache
+	EmergencyCaKey           []byte                   `protobuf:"bytes,11,opt,name=emergency_ca_key,json=emergencyCaKey,proto3" json:"emergency_ca_key,omitempty"`
 }
 
 func (x *IssueJoinTicketResponse) Reset() {
@@ -202,6 +202,13 @@ func (x *IssueJoinTicketResponse) GetKubernetesComponents() []*components.Compon
 	return nil
 }
 
+func (x *IssueJoinTicketResponse) GetEmergencyCaKey() []byte {
+	if x != nil {
+		return x.EmergencyCaKey
+	}
+	return nil
+}
+
 type ControlPlaneCertOrKey struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
@@ -367,7 +374,7 @@ var file_joinservice_joinproto_join_proto_rawDesc = string([]byte{
 	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x12, 0x28, 0x0a, 0x10, 0x69, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x70,
 	0x6c, 0x61, 0x6e, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x69, 0x73, 0x43, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x22, 0x8e, 0x04, 0x0a, 0x17, 0x49,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x22, 0xb8, 0x04, 0x0a, 0x17, 0x49,
 	0x73, 0x73, 0x75, 0x65, 0x4a, 0x6f, 0x69, 0x6e, 0x54, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x52, 0x65,
 	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x74, 0x61, 0x74, 0x65, 0x5f,
 	0x64, 0x69, 0x73, 0x6b, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c,
diff --git a/keyservice/keyserviceproto/keyservice.pb.go b/keyservice/keyserviceproto/keyservice.pb.go
index 63287a6a8..9008be73e 100644
--- a/keyservice/keyserviceproto/keyservice.pb.go
+++ b/keyservice/keyserviceproto/keyservice.pb.go
@@ -8,14 +8,15 @@ package keyserviceproto
 
 import (
 	context "context"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	grpc "google.golang.org/grpc"
 	codes "google.golang.org/grpc/codes"
 	status "google.golang.org/grpc/status"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
 )
 
 const (
@@ -121,6 +122,87 @@ func (x *GetDataKeyResponse) GetDataKey() []byte {
 	return nil
 }
 
+type GetCAKeyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetCAKeyRequest) Reset() {
+	*x = GetCAKeyRequest{}
+	mi := &file_keyservice_keyserviceproto_keyservice_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetCAKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCAKeyRequest) ProtoMessage() {}
+
+func (x *GetCAKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_keyservice_keyserviceproto_keyservice_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCAKeyRequest.ProtoReflect.Descriptor instead.
+func (*GetCAKeyRequest) Descriptor() ([]byte, []int) {
+	return file_keyservice_keyserviceproto_keyservice_proto_rawDescGZIP(), []int{2}
+}
+
+type GetCAKeyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CaKey []byte `protobuf:"bytes,1,opt,name=ca_key,json=caKey,proto3" json:"ca_key,omitempty"`
+}
+
+func (x *GetCAKeyResponse) Reset() {
+	*x = GetCAKeyResponse{}
+	mi := &file_keyservice_keyserviceproto_keyservice_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetCAKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCAKeyResponse) ProtoMessage() {}
+
+func (x *GetCAKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_keyservice_keyserviceproto_keyservice_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCAKeyResponse.ProtoReflect.Descriptor instead.
+func (*GetCAKeyResponse) Descriptor() ([]byte, []int) {
+	return file_keyservice_keyserviceproto_keyservice_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetCAKeyResponse) GetCaKey() []byte {
+	if x != nil {
+		return x.CaKey
+	}
+	return nil
+}
+
 var File_keyservice_keyserviceproto_keyservice_proto protoreflect.FileDescriptor
 
 var file_keyservice_keyserviceproto_keyservice_proto_rawDesc = string([]byte{
@@ -159,10 +241,12 @@ func file_keyservice_keyserviceproto_keyservice_proto_rawDescGZIP() []byte {
 	return file_keyservice_keyserviceproto_keyservice_proto_rawDescData
 }
 
-var file_keyservice_keyserviceproto_keyservice_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_keyservice_keyserviceproto_keyservice_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
 var file_keyservice_keyserviceproto_keyservice_proto_goTypes = []any{
 	(*GetDataKeyRequest)(nil),  // 0: kms.GetDataKeyRequest
 	(*GetDataKeyResponse)(nil), // 1: kms.GetDataKeyResponse
+	(*GetCAKeyRequest)(nil),    // 2: kms.GetCAKeyRequest
+	(*GetCAKeyResponse)(nil),   // 3: kms.GetCAKeyResponse
 }
 var file_keyservice_keyserviceproto_keyservice_proto_depIdxs = []int32{
 	0, // 0: kms.API.GetDataKey:input_type -> kms.GetDataKeyRequest
@@ -185,7 +269,7 @@ func file_keyservice_keyserviceproto_keyservice_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_keyservice_keyserviceproto_keyservice_proto_rawDesc), len(file_keyservice_keyserviceproto_keyservice_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/keyservice/keyserviceproto/keyservice.proto b/keyservice/keyserviceproto/keyservice.proto
index d2ce62ffc..0ae5b7d89 100644
--- a/keyservice/keyserviceproto/keyservice.proto
+++ b/keyservice/keyserviceproto/keyservice.proto
@@ -4,15 +4,15 @@ package kms;
 
 option go_package = "github.com/edgelesssys/constellation/v2/keyservice/keyserviceproto";
 
-service API {
-  rpc GetDataKey(GetDataKeyRequest) returns (GetDataKeyResponse);
-}
+service API { rpc GetDataKey(GetDataKeyRequest) returns (GetDataKeyResponse); }
 
 message GetDataKeyRequest {
   string data_key_id = 1;
   uint32 length = 2;
 }
 
-message GetDataKeyResponse {
-  bytes data_key = 1;
-}
+message GetDataKeyResponse { bytes data_key = 1; }
+
+message GetCAKeyRequest {}
+
+message GetCAKeyResponse { bytes ca_key = 1; }