Product 01
Every certificate your business trusts should trace back to a key you control. The Root CA System gives you that key — generated inside a hardware security module, protected by physical tokens and dual control, and surrounded by the services that make its decisions verifiable to everyone else.
Why own a root
Public certificate authorities are excellent at one job: proving a domain name to a stranger. They are a poor fit for everything else — internal service identity, device fleets, signed invoices, partner file exchange — where you need control over policy, lifetime, naming and revocation, and where per-certificate pricing quietly becomes an architecture constraint.
Running your own root has always been possible. What made it hard was everything around the root: the ceremony, the offline media, the responder that has to answer in milliseconds, the revocation list nobody remembers to publish, the auditor who wants the witness statement. That surrounding apparatus is what this product actually is.
Root and SubCA keys are generated inside the HSM. There is no file to copy, no passphrase to leak, no backup tape to lose.
Issuance from the root requires a quorum of operator tokens. One compromised laptop is not enough.
Certificate Policy and CPS written alongside the deployment, with the ceremony recorded and witnessed.
Pre-signed OCSP responses and cached CRLs mean validation does not become your latency budget.
Architecture
An air-gapped root that signs rarely, issuing SubCAs that sign constantly, and the validity services that let the rest of the world check both.
Modules
Each module runs independently and speaks a published standard, so you can adopt them in stages rather than in one nervous weekend.
Operator identity lives on a physical token instead of a shared password, and sensitive operations require a touch.
A YubiHSM 2 becomes the only place your private keys have ever existed, exposed through the PKCS#11 interface your tooling already speaks.
An RFC 6960 responder that answers the question every TLS handshake asks: is this certificate still good?
Revocation lists published on a schedule you set, reachable at the exact URLs your certificates advertise.
Delegate issuance to a SubCA per purpose or business unit, so a mistake in one domain cannot contaminate another.
An RFC 3161 timestamp authority, so a signature made today is still provably made today in five years.
The PDF Signer: turns approved documents into signatures that hold up in front of a regulator.
Specification
If a relying party already implements the RFC, it already works with us.
In production
Short-lived certificates for every internal service, renewed automatically over ACME instead of by calendar reminder.
Contracts, statements and e-invoices signed with PAdES B-LT so they remain verifiable years after issuance.
Factory-provisioned identities for hardware, and SPIFFE-style identity for containers and workloads.
Client certificates issued to counterparties, checked live by SftpS on every connection.
YubiKey PIV credentials for VPN, Wi-Fi, SSH and privileged access, all issued from one authority.
Timestamped audit records and archives that satisfy a regulator long after the signing certificate expired.
We will walk your team through a live system, then scope what it takes to run one in your environment — ceremony, hardware and policy included.
