Your private certificate authority
Build root and intermediate authorities, sign CSRs, and export certificates and chains. Track expiry and publish revocations through CRL and OCSP.
Explore certificate management YOUR FOUNDATION FOR DIGITAL TRUST
Confidence,
in every
signature.
Certificates, OpenPGP keys, signed email, and software releases. Manage your identities and automate signing from one private workspace.
✓ Encrypted key storage✓ Scoped API access✓ Private PKI
CERTIFICATES. KEYS. VERIFIED SIGNATURES.
ONE WORKSPACE. CONNECTED WORKFLOWS.X.509 certificatesOpenPGP / GPGS/MIME emailDebian / APTACMEREST API
BUILT FOR THE WHOLE LIFECYCLE
One place for every
signing identity.
From your first certificate to your next release,
keep keys, signatures, and trust connected.
OpenPGP & GPG keys
Generate keys, import and export public keys, and download protected private keys. Sign and verify files, encrypt and decrypt content, and revoke compromised keys.
Explore OpenPGP workflowsS/MIME & signed email
Issue email certificates and protected PKCS#12 bundles for your mail clients. Create signed S/MIME or PGP/MIME messages, ready to download and send through your mail workflow.
Explore email signingDebian & APT signing
Create InRelease and Release.gpg for your repository. Sign source, upload, and build metadata, or produce a detached signature for a binary .deb package.
Explore release signingYour public key exchange
Choose which public keys to share. Let others find published identities by name, email, or fingerprint, and retrieve keys from the directory, GnuPG, or the API.
Browse public keysAutomation with visibility
Connect every signing workflow through scoped REST APIs. Use ACME for certificates, send expiration alerts to your team, and follow operations in the audit trail.
Build your integrationLive infrastructure trust
Observe deployed certificates, connect renewal agents, and enforce versioned policies with independent approvals. Rehearse recovery before an incident.
Explore trust operations →Identity for people and services
Use XXC Trust as your OpenID Connect sign-in provider. Add passkeys, isolate team workspaces, and exchange trusted workload assertions for short-lived service certificates.
Explore identity integrations →Evidence you can verify
Export signed release provenance and SBOMs, preserve independent audit checkpoints, and assess post-quantum algorithms with measured signing experiments.
Explore verification →BUILT FOR THE TOOLS YOU USE
From a message
to a software release.
Use the console for your next signing task, or connect your mail and build pipelines through the API. Download formats your existing tools understand.
- Signed .eml messages and PKCS#12 certificate bundles
- Releases
- InRelease, Release.gpg, and signed Debian metadata
- Public keys
- ASCII armor and binary GPG keyrings
AUTOMATE YOUR NEXT RELEASE
One request. Both APT signatures.
POST /api/v1/debian/sign
Authorization: Bearer $CA_TOKEN
{
"key_id": "YOUR_SIGNING_KEY_ID",
"kind": "release",
"data_base64": "BASE64_RELEASE_FILE"
}Prepare your repository’s Release file, then receive InRelease and Release.gpg as downloadable signing artifacts.
Read the API referenceSHARE PUBLIC IDENTITIES
Your public keys.
Ready to be found.
Keys start unpublished. An administrator publishes each key together with its user IDs. Published revocations remain available so others can keep their keyrings current.
Open the public key exchangeCONTROL AT EVERY LAYER
Powerful tools.
Thoughtful safeguards.
Encrypted private keys, role-based access, multi-factor authentication, and separate API permissions for signing, export, and publication keep your workspace under control.
Every signing workflow leaves an audit trail. Certificate expiry alerts connect to Discord, Slack, Teams, or your own webhook.
See how it works →