Own your trust infrastructure.
Issue and control private certificates across your systems. Define identity, enforce policy, and remove dependency on public CAs.
What you control
Internal certificates under your control
Identity for every service, agent, and user
Policy-driven issuance and lifecycle
Immediate revocation inside your network
No dependency on public certificate authorities
Certificates become identity
Every entity in your system receives a certificate-based identity.
APIs, workloads, microservices
Monitoring, automation, A2A
Admin tools and privileged access
Short-lived break-glass credentials
Identity is issued, scoped, rotated, and revoked automatically.
Issuance is policy-driven
Define certificate behaviour once:
Lifetimes
Set validity periods per identity type and use case.
Key types and strength
Choose algorithms and key sizes per certificate profile.
SAN and domain constraints
Restrict which names and domains each profile can issue.
Identity types and usage
Map certificate profiles to service, agent, user, or emergency roles.
Every certificate follows policy. No drift. No manual decisions.
Controlled lifetimes
Certificates match your systems–not browser rules.
Long-lived for stable internal services
Short-lived for sensitive access
No forced renewal cycles
Not defined by browser rules. Defined by your systems.
Immediate revocation
Revoke any certificate instantly.
No CRL propagation delays
No external dependency
Enforcement happens inside your network
Revocation is enforced instantly–not eventually.
Client and server certificates
Trust CA issues both:
Secure endpoints
Prove identity
Public CAs don't issue client identity.
Trust CA does.
Every service proves who it is before communication begins.
This enables mutual TLS (mTLS) across your infrastructure.
Learn more about mTLSOnce defined, the system handles everything
Entity is defined and scoped
Validated against your trust rules
Private key created on the machine
Signing request submitted securely
Issued and installed automatically
Renewal and rotation handled by policy
Private keys never leave the machine.
Policy-enforced lifecycle
Every certificate follows the same model:
All actions are enforced by policy and recorded automatically.
Nothing operates outside the system.
Two-tier PKI. Zero external dependencies.
[cyphrs]™ Trust CA runs a proper two-tier certificate hierarchy – a Root CA that never touches end-entity certificates, and an Intermediate CA that handles all issuance. The root key stays isolated. The intermediate rotates without re-establishing trust across your fleet. One key compromised doesn't mean starting over.
Everything runs inside your network. Rust core. PostgreSQL persistence. No SaaS callbacks, no phone-home telemetry. Your keys never leave your perimeter – because they were never supposed to.
Registration Authority validates requests and enforces policy before the CA signs. The API layer cannot bypass policy.
ECDSA P-256 / P-384 / RSA-4096. All FIPS 140-3 approved. ECDSA P-256 default – smallest key, fastest handshake.
Server and client private keys generated on the machine that will use them. Trust CA signs a CSR you submit. No key escrow.
CA private keys encrypted with AES-256-CBC via HKDF-SHA256. Zeroized from memory on process exit.
Scout runs on every managed endpoint. It generates private keys locally, submits CSRs to Trust CA, receives signed certificates, and deploys them to the service. Stale agents are auto-disabled. Orphaned credentials are revoked. The agent that discovered your certificates is the same agent that manages them.
Where it's used
Trust CA is used wherever identity matters:
Authenticate and encrypt internal service communication.
Identity for every service in your mesh.
Short-lived certificates scoped to namespace and workload.
Certificates for internal IPs and private domains.
Certificate-based identity for privileged systems.
Mutual authentication between every communicating pair.
If it doesn't need browser trust–it shouldn't use a public CA.
Part of the system
Trust CA operates inside [cyphrs]™ Hub:
Identifies certificates across your estate
Assigns the right trust model
Issues internal identity
Handles public certificates
Own your trust infrastructure
Early access is free. We're working with a small number of teams to shape the platform.