Tooling

Beyond the confium CLI, the workspace ships five binaries and four adapter libraries. Each is documented in its own page below.

Binaries

Tool Crate Description
confiumd confium-daemon Long-running JSON-RPC service for signing sessions, transparency log, PKI operations.
confium-publish confium-publish Plugin author’s publishing tool — wraps, signs, and stages plugins for the registry.
confium-pkcs11-server confium-pkcs11-server PKCS#11 v3.0 server — exposes Confium as an HSM to existing PKCS#11 consumers.
confium-test-harness confium-test-harness NIST MPTS evaluation harness.
sim confium-test-harness Multi-party threshold simulation runner.

Adapter libraries

Adapter Crate Consumers
OpenSSL provider confium-openssl-provider nginx, Apache, custom OpenSSL consumers.
JCE provider confium-jce-provider Java applications via KeyStore / Cipher / Signature APIs.
TLS signer confium-tls-signer TLS 1.3 signature callback for high-value domains.

The adapter pattern is uniform: existing consumer code stays unchanged, but every cryptographic call dispatches into a Confium threshold session behind the scenes.

Choosing

  • Existing PKCS#11 consumer (OpenSSL ENGINE_pkcs11, Java SunPKCS11, nginx with PKCS#11 module)? Use confium-pkcs11-server.
  • OpenSSL 3.0 native consumer (modern nginx, curl, custom C)? Use confium-openssl-provider.
  • Java application? Use confium-jce-provider.
  • TLS terminator needing threshold signing? Use confium-tls-signer.

See Mode 2 — PKI Drop-in for the broader integration story.

See also