Docs

Confium's engine, plugin loader, versioned interfaces, coordinator, and the principles that shape every crate.

Mode 1 (Peer-to-Peer TC), Mode 2 (PKI Drop-in), Mode 3 (Sovereign PKI). One engine, three integration shapes.

Nodes do threshold cryptography directly. Hours to value. The simplest deployment shape.

Replace single-party keys with threshold keys. Existing PKCS#11 / OpenSSL / JCE consumers keep working unchanged.

Custom certificate formats for institutions where no single party can be trusted. Sovereign over formats, delegation, archival, quorum.

The 43-crate Confium Rust workspace, grouped by category. Engine, threshold crypto, PKI, storage, network, Mode 2 adapters, transparency.

Confium's threat model, trust assumptions, and defense-in-depth layers. What the framework protects against and what it expects of operators.

Migrate from classical to post-quantum signatures via composite signatures. Software upgrade, not HSM replacement. No certificate re-issuance flag day.

RFC 6962 Merkle transparency logs. Inclusion proofs, consistency proofs, witness gossip, OTS anchoring. How split-view attacks are detected.

Quickstart hub for Confium — Ruby, Rust, and WASM install commands and pointers into per-binding docs.

Confium vs HSMs, conventional CAs, KMS, Sigstore, and commercial threshold solutions. Where each fits, where each falls short.

FIPS 140 mode, jurisdictional algorithm policies, audit log format, and regulatory mapping to eIDAS, HIPAA, FedRAMP, and Common Criteria.

The confium command-line tool — install, manage, and operate Confium plugins, signers, and the local configuration store.

Common questions about Confium — what it is, how it works, when to use it, and the limits of threshold-native trust infrastructure.

Print the version of the confium CLI and the underlying engine.

Operational gotchas, common errors, and their fixes for Confium deployments and consumers.

Install a Confium plugin from the registry. Currently a stub awaiting the confium-net HTTP-fetching crate.

Remove an installed Confium plugin from the local store.

Update an installed plugin to the latest version. Currently a stub awaiting the confium-net HTTP-fetching crate.

List installed Confium plugins, optionally filtered by interface or algorithm.

Show detailed information about an installed Confium plugin.

Search the Confium plugin registry for available plugins.

Manage the trusted-publisher list — which publishers' plugins the local install will accept.

Read and write local Confium configuration.

The confiumd daemon — long-running JSON-RPC service for signing sessions, transparency log interaction, and PKI operations.

The plugin author's publishing tool — wraps a plugin artifact, signs the manifest, and prepares it for submission to the Confium registry.

Binaries and adapter libraries shipped by the Confium workspace — beyond the CLI.

PKCS#11 v3.0 server — exposes Confium threshold signing to existing PKCS#11 consumers (OpenSSL ENGINE, Java SunPKCS11, nginx).

OpenSSL 3.0 provider — exposes Confium threshold signing to modern OpenSSL consumers (nginx, curl, custom C).

Java Cryptography Extension provider — exposes Confium threshold signing to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — high-value domain protection with threshold signing for handshakes.

NIST MPTS evaluation harness + multi-party threshold simulation runner.

Deep dives into the Mode 2 adapters — PKCS#11, OpenSSL 3.0, JCE, TLS 1.3. How they wire existing consumers into Confium.

PKCS#11 v3.0 adapter — expose Confium as a virtual HSM to OpenSSL, Java, nginx, and custom consumers.

OpenSSL 3.0 provider — expose Confium to modern OpenSSL consumers in-process.

Java Cryptography Extension provider — expose Confium to Java applications via KeyStore / Cipher / Signature APIs.

TLS 1.3 signature callback — threshold signing for high-value domain TLS handshakes.