Key Custody Modes
Choose between SecuriTLS custody, storage encryption BYOK, certificate only imports, and Satellite private key self custody.
SecuriTLS custody
In the default model, private key material is encrypted before being written to a storage provider. SecuriTLS manages the wrapping keys required to use the storage DEK.
This model is simple to operate and supports certificate generation, renewal, rekey, deployment, and private key recovery workflows inside SecuriTLS.
Storage encryption BYOK
Business and Enterprise customers can configure AWS KMS so that the SecuriTLS generated storage DEK is wrapped by a customer controlled KMS key.
This improves control over encrypted assets at rest, but it is not the same as private key self custody. SecuriTLS may still use the unwrapped DEK to read encrypted private key material when performing platform managed workflows.
Satellite private key custody
Team, Business, and Enterprise customers can use SecuriTLS Satellites for local key custody workflows. A Satellite runs inside the customer environment and connects outbound to SecuriTLS.
With Satellite custody, private key generation, CSR creation, signing, decryption, and deployment can happen locally. SecuriTLS coordinates the workflow but does not need plaintext private key access.
CSR based workflows
When a certificate key is controlled by a Satellite, the Satellite can generate a CSR that contains the public key and requested subject information. A signing CA or signing Satellite can then issue the certificate from that CSR without receiving the subject private key.
This supports cross environment workflows where one Satellite controls the certificate key and another Satellite controls the signing CA key.
Certificate only imports
Imported X.509 certificates can be managed without importing a private key. In this mode, SecuriTLS can track inventory, expiration, issuer metadata, SANs, deployment status, CRLs, and alerts.
Certificate only imports cannot deploy private keys, create combined key plus certificate files, or renew using the same private key unless key custody is later verified through SecuriTLS custody or Satellite custody.
Satellite custody imports
If a customer already has a matching private key inside a Satellite environment, the Satellite can prove custody by generating a CSR from that key. SecuriTLS can compare the CSR public key to the imported certificate public key.
If the keys match, the certificate can be marked as Satellite custody without SecuriTLS ever receiving the plaintext private key.