Confium PKI

Parse, verify, and produce PQ-composite signatures — the three things every PKI integration needs.

1. 1

   Install

   cargo install --locked confium-cli

   cargo install --locked confium-cli

2. 2

   Parse a cert

   Inspect an existing X.509 certificate.

   confium pki parse-cert --in example.der
   # Subject: CN=example.com
   # Issuer: CN=Confium Test CA
   # Serial: 4A:3F:...
   # Not After: 2027-08-07T00:00:00Z

3. 3

   Verify a cert chain

   Verify a leaf cert against an anchor.

   confium pki verify \\
       --cert example.der \\
       --anchor root.der
   # → valid

4. 4

   Composite sign (PQ migration)

   Sign a payload with classical + PQ keys.

   confium pki composite-sign \\
       --message "hello" \\
       --classical-key ed25519.key \\
       --pq-key mldsa.key \\
       --out composite-sig.bin

5. 5

   Verify composite

   Verify the composite signature.

   confium pki composite-verify \\
       --message "hello" \\
       --signature composite-sig.bin \\
       --classical-pubkey ed25519.pub \\
       --pq-pubkey mldsa.pub
   # → valid