Kryptkeeper
Feature

Certificate authorities

Your own root and issuing CAs, with dual control where it matters.

Create a root and the issuing CAs under it, or import a root you already trust. Sensitive operations on a CA are guarded, and a new root key can require an M-of-N key ceremony.

kryptkeeper.example.com/cas

How it works

  1. Create a root CA

    Create a self-signed root with the algorithm and lifetime you choose.

    9 steps

  2. Create an issuing CA under a root

    Create an intermediate CA that signs your day-to-day certificates.

    7 steps

  3. Import an existing root

    Import a root you already trust as a trust anchor.

    7 steps

  4. Inspect a CA and its hierarchy

    Read a CA's details and see the whole chain at a glance.

    6 steps

  5. Suspend, re-key or revoke a CA

    Change a CA's state through guarded actions that show what they affect.

    18 steps

  6. Run a root key ceremony (M-of-N)

    One person starts a ceremony and two approvers complete the quorum.

    14 steps

Docs

Paths that use this