Certificate authority keys
Issue certificates under quorum and approval.
The problem
Why it matters.
A CA key is the most valuable key many organizations hold. Every issuance should be traceable to a decision, not just to a server login.
With Roost
How Roost handles it.
01
RequestA certificate request arrives with a CSR.
02
ApprovalIssuance follows your approval rules.
03
QuorumTwo of three chips sign the certificate.
SIGNED
RecordIssuance is sealed with who approved it.
What you get
In the console.
- Keys born inside the appliance, with a birth record signed by several chips
- CSR created inside the box
- Certificate chain stored next to the key
- Rotation and retirement under approval
AxowlacmeRoostM
Approvals
3pending
14approved this week
1refused
| Request | Detail | Seals | |
|---|---|---|---|
| Release 1.4.2 · code signing | Approve to sign build 842 | 1 of 2 | Approve with passkey |
| Issue certificate · api.acme.example | CA key · 2 of 3 security officers | 2 of 3 | Approve with passkey |
| Share key piece with backup box | ROOST-26-0003 joins the domain | 0 of 3 | Approve with passkey |
| Retire key version v1 | data-key · 0 records still on v1 | Done | Approved |
See Roost refuse an unapproved signature.
A 30-minute live demo with our engineers.