t;string></code></td><td>The domain serves to identify the system with SPIFFE. (default ``)</td></tr><tr><td><code>--upstream-ca-address &lt;string></code></td><td>The IP:port address of the upstream CA. When set, the CA will rely on the upstream Citadel to provision its own certificate. (default ``)</td></tr><tr><td><code>--workload-cert-grace-period-ratio &lt;float32></code></td><td>The workload certificate rotation grace period, as a ratio of the workload certificate TTL. (default `0.5`)</td></tr><tr><td