`confium-tls-signer`

The TLS signer is a library (not a binary) that provides a TLS 1.3 signature callback hook. Modern TLS libraries (OpenSSL, BoringSSL, rustls) support asynchronous signature callbacks; the Confium TLS signer plugs in and routes each handshake signature through a threshold session.

When to deploy

You operate a high-value TLS-terminating service (banking, identity provider, government).
A single signing key on the terminator is a structural risk.
You want signing authority split across multiple parties or regions.
You can tolerate ~150ms handshake overhead (typical for a cross-region threshold session).

Install (Rust library)

[dependencies]
confium-tls-signer = "0.3"
rustls = "0.23"   # or your TLS library of choice

Architecture

[ TLS handshake ] ─── needs signature ─── [ TLS library ]
                                              │
                                              │ asks the configured
                                              │ signer to produce a sig
                                              ▼
                                       [ Confium TLS signer ]
                                              │
                                              │ dispatches to coordinator
                                              ▼
                                       [ Threshold session ]
                                       (T-of-N signers)
                                              │
                                              ▼
                                       [ Standard signature ]
                                       (verifier doesn't notice)

Usage with rustls

use rustls::sign::SigningKey;
use confium_tls_signer::ThresholdSigningKey;

let signing_key = ThresholdSigningKey::new(
    coordinator: "tcp://coordinator.internal:7443",
    public_key: my_cert_public_key,
    algorithm: "ECDSA-P256",
)?;

// Hand this to rustls as the server's signing key.
let server_config = ServerConfig::builder()
    .with_no_client_auth()
    .with_certifier(cert_chain, vec![signing_key]);

Usage with OpenSSL 3.0

OpenSSL 3.0’s provider API supports signing callbacks. Use the confium-openssl-provider and configure it for the TLS handshake algorithm:

[algorithms]
ECDSA-P256 = "confium"   # Routes TLS handshake sigs through Confium

See the OpenSSL provider docs for details.

Latency considerations

A TLS handshake adds ~150ms with a cross-region threshold session. For high-traffic sites:

Use a coordinator co-located with the TLS terminator (~30ms).
Batch handshakes per session (the threshold session can produce multiple signatures per round).
Cache session resumption tickets aggressively — resumption doesn’t require a new signature.

Compatibility

TLS library	Status
rustls	✅ full support via `SigningKey` trait.
OpenSSL 3.0	✅ via the provider API.
BoringSSL	✅ via the provider API (OpenSSL-compatible).
wolfSSL	⏳ callback API exists; integration in progress.
Java JSSE	✅ via the JCE provider + SunJSSE.

confium-tls-signer