Confium PKI

Run a CA without a single trusted key.

CA OperatorsEnterprise PKI TeamsInstitutional PKI

Installation options

Pick the install path that matches your deployment. Confium Confium PKI is available as a Rust crate, a Docker image, a language-specific package, or a hosted service depending on surface.

Rust crate

cargo add confium-pki
# Full PKI product surface:
cargo add confium-pki --features full

PKCS#11 server (HSM replacement)

docker pull confium/pkcs11-server:latest
docker run -p 2345:2345 -v ./shares:/etc/confium/shares:ro confium/pkcs11-server

OpenSSL 3.0 provider

cargo install confium-openssl-provider
# Add to openssl.conf:
# provider = confium
# /usr/lib/ossl-modules/confium.so

JCE provider (Java)

Download the JAR; add to classpath:

<dependency>
  <groupId>org.confium</groupId>
  <artifactId>confium-jce</artifactId>
  <version>0.3.0</version>
</dependency>

TLS signer

docker pull confium/tls-signer:latest