The problem
Why it matters.
A TLS private key on a web server can be copied in a memory dump. Moving it into hardware keeps your server identity safe even if the server is breached.
With Roost
How Roost handles it.
01
HandshakeA client connects to your server.
02
SignThe server asks Roost to prove its identity.
03
QuorumTwo of three chips sign.
SIGNED
ConnectedBulk traffic stays on the server CPU.
What you get
In the console.
- Private key cannot be exported
- A breached server cannot take the key and is limited in how much it can sign
- High availability with a pair of appliances
- Session resumption keeps the signing load low
AxowlacmeRoostM
Devices
2boxes
1pair
0alerts
| Serial | Site | Voters | Tamper | Firmware | Status |
|---|---|---|---|---|---|
| ROOST-26-0001 | Seoul HQ, vault floor | 3/3 | Armed | 1.1.0 (B) | Green |
| ROOST-26-0002 | Busan DR site | 3/3 | Armed | 1.1.0 (B) | Green |
Chip temp46–50 °C
Mesh100.1 %
TimeNTS · 8 ms
AttestationMatch
See Roost refuse an unapproved signature.
A 30-minute live demo with our engineers.