Confium PKI

Confium PKI is the public-key-infrastructure product: run a CA without a single trusted key. Issue, revoke, and prove via threshold signing.

Components

• confium-pki — X.509 cert, CSR, CMS SignedData, XMLDSig
• confium-composite — Composite signatures for PQ migration
• confium-attributes — Attribute-based signing predicates
• confium-pkcs11-server — Drop-in HSM replacement via PKCS#11
• confium-openssl-provider — OpenSSL 3.0 provider
• confium-jce-provider — Java Cryptography Extension provider
• confium-tls-signer — TLS 1.3 signature callback

Concepts

• Threshold CA lifecycle
• OCSP / CRL from threshold keys
• ACME integration
• Composite signatures (PQ migration)
• Attribute-based signing policies

How-to

• Deploy PKCS#11 server as HSM replacement
• Configure OpenSSL 3.0 provider
• Integrate JCE into Java apps
• Stand up a threshold CA

Reference

• Rust API
• Threshold CA spec
• Composite signatures spec
• PKCS#11 server spec

In this section

• Concepts — threshold CA, composite signatures, legacy XML
• How-to — run the PKCS#11 bridge, use the OpenSSL provider, produce a composite signature
• Reference — CLI

Cross-links

• Confium architecture
• Confium PKI on the website