Availability

Satellites are available on Team, Business, and Enterprise plans. Solo users can manage certificates directly, but production Satellite workflows start at Team.

How it works

1. Install the SecuriTLS Satellite inside your environment.
2. The Satellite connects outbound to SecuriTLS.
3. SecuriTLS sends certificate, CRL, CSR, signing, or deployment jobs through that connection.
4. The Satellite performs the operation locally and returns status to SecuriTLS.

This avoids opening inbound firewall access from SecuriTLS to internal servers.

Satellite deployment

Satellites can deploy certificates, chains, CRLs, and private keys to SSH devices from inside your private network. This is useful for private infrastructure, segmented networks, and environments where direct public SSH access is not acceptable.

Private key custody

Satellites can support true private key self custody by keeping key generation, CSR creation, signing, decryption, and deployment inside the customer environment.

This is different from AWS KMS storage BYOK. AWS KMS BYOK controls the wrapping key for the SecuriTLS generated storage DEK. Satellite custody controls where private keys are generated and used.

Cross Satellite workflows

If the certificate key and the signing CA key live on different Satellites, SecuriTLS can coordinate a CSR based flow. The certificate Satellite generates the CSR, and the signing Satellite signs the final certificate without receiving the subject private key.