Confium PKI

Run a CA without a single trusted key.

CA OperatorsEnterprise PKI TeamsInstitutional PKI

API reference

Canonical code shapes for Confium PKI, with per-language tabs. Copy-paste-runnable.

Parse + verify a certificate

{`use confium_pki::Certificate;

let cert = Certificate::from_der(&der_bytes)?;
println!("Subject: {}", cert.subject());
println!("Not after: {}", cert.not_after());
cert.verify_chain(&[root_cert])?;`}

{`confium pki parse-cert --in cert.der
confium pki verify --cert cert.der --anchor root.der`}

{`from confium.pki import Certificate

cert = Certificate.from_der(der_bytes)
print("Subject:", cert.subject)
cert.verify_chain([root_cert])`}

Composite signature (PQ migration)

{`use confium_composite::{CompositeSignature, Component};

let sig = CompositeSignature::sign_multi(
    &[("ed25519", &ed_privkey), ("ml-dsa-65", &mldsa_privkey)],
    b"message",
)?;
assert!(sig.verify(b"message")?);`}

{`confium pki composite-sign \\
    --message "message" \\
    --classical-key ed25519.key \\
    --pq-key mldsa.key \\
    --out sig.bin
confium pki composite-verify --message "message" --signature sig.bin`}

Confium PKI

API reference

Parse + verify a certificate

Composite signature (PQ migration)

Auto-generated docs