Offline Root
The root key never touches a networked host. Issuing CAs are cross-signed from an air-gapped ceremony.
Sanctum Certificate Services
Issuance, renewal and revocation for the Sanctum and Cygnet trust hierarchies. Profiles are fixed, curves are approved, and every issuance is attributable.
Issuing Hierarchy
Separate issuing CAs per certificate class so a compromise is contained to one profile.
Automated Enrollment
ACME and device-attested enrollment paths with short-lived leaf certificates.
Revocation Freshness
CRL and OCSP publication is monitored, with alerting before a responder goes stale.
Also published under the CygnetSSL brand at ca.cygnetssl.com. Zone cygnetssl.com. Gate open.