Skip to content

Secsy PKI

An HSM-backed enterprise PKI: X.509 and SSH certificate authorities, automated enrollment, signing and timestamping services, and envelope-based secret encryption — with every private key generated inside the hardware, and never leaving it.

Deploy it Documentation map Worked examples

  •   Keys never leave the hardware

    One key-provider abstraction routes every signing operation to a PKCS#11 HSM, a cloud KMS, Vault Transit — or SoftHSM for development. Keys are generated on the device, marked non-extractable, and can prove it: hardware attestation and a remotely verifiable audit log show a third party that a given key signed nothing beyond what was published.

    HSM & key management

  •   The whole certificate lifecycle

    Bootstrap root and intermediate CAs, issue from profiles, renew, revoke, and publish CRLs and OCSP — including delta CRLs, sharding, pre-signed responses and CDN offload. Rotate an intermediate with a dual-chain overlap, cross-sign for a bridge, or run a subordinate under a third-party root.

    Certificate authority

  •   Enrollment that runs itself

    ACME (RFC 8555) with ARI, profiles, STAR and every challenge type; SCEP, EST and CMP for devices and MDM; BRSKI zero-touch onboarding; Windows autoenrollment over MS-XCEP/MS-WSTEP; plus a host agent that renews and installs certificates on its own.

    Enrollment protocols

  •   Gates that fail closed

    Nothing reaches the HSM before it passes: CA/Browser Forum linting, DNS CAA (with accounturi), name constraints and policy OIDs, weak- and compromised-key checks, Certificate Transparency with inclusion-proof monitoring — and a dry-run endpoint that reports the verdict without signing anything.

    Issuance policy & gates

  •   More than certificates

    The same hardware backs envelope encryption for passwords and secrets — with M-of-N escrow, KEK rotation and format-preserving tokenization — plus code and artifact signing, an RFC 3161 timestamping authority, and long-term evidence records.

    Secrets  ·  Signing

  •   Built to be audited

    A hash-chained, RFC 3161-anchored audit log; four-eyes approvals over sensitive operations; OIDC SSO, LDAP/AD, mTLS and WebAuthn step-up; multi-tenant isolation; FIPS 140-3 mode — and a CP/CPS with its controls mapped to the code that enforces them.

    Security & governance

Start here

If you want to… Go to
Copy a working setup Worked examples — an SSH PKI, keyless signing from GitHub Actions, ACME TLS automation, a private mTLS CA
Deploy for the first time HSM configuration → Certificate authority → RBAC & audit
Move to production Production HSM migration → Key ceremony & DR → Observability
Run it on Kubernetes Kubernetes deployment → Multi-replica coordination
Operate a live deployment Operator runbook — keep it bookmarked
Respond to a key compromise Incident response: mass revocation
Prepare for a WebTrust audit Certificate Policy / CPS · control mapping
Understand why it is built this way Architecture · decision records

The tools at a glance

Binary Purpose Build
secsy-pki-server The HTTP server, web console, and API go build -tags sqlite -o secsy-pki-server ./cmd/server
secsy-ca CA setup and certificate lifecycle go build -tags sqlite -o secsy-ca ./cmd/secsy-ca
secsy-secret HSM-backed secret encryption go build -tags sqlite -o secsy-secret ./cmd/secsy-secret
secsy-agent Host auto-enrollment / renewal daemon go build -o secsy-agent ./cmd/secsy-agent
secsy-ssh OIDC SSH client wrapper go build -o secsy-ssh ./cmd/secsy-ssh
secsy-verify Offline HSM audit-log verifier go build -o secsy-verify ./cmd/verify

All CLIs accept -config config.yaml and share the server's configuration, database and key provider. Run any command with -h for its flags.

Everything here is generated from the repository

These pages are the Markdown under docs/ in the repository, published unchanged. Every page has an edit link to its source; see how the site is built.