Custody boundaries
Keep sensitive key material and operations closer to the customer environment.
Customer-side PKI execution
Keep private key operations inside infrastructure you control.
SecuriTLS Satellites provide customer-side certificate execution with Satellite-encrypted private keys or HSM-backed keys that remain within the configured HSM custody boundary.
Use AWS KMS, Azure Key Vault, Google Cloud KMS, Vault, or local encryption for Satellite custody, and integrate HSM-backed certificate workflows through Vault or compatible KMIP infrastructure.
LocalKey operations
OutboundConnectivity
CentralVisibility
Why satellites exist
Central management does not have to mean central key custody.
Some organizations want the visibility and workflow benefits of a SaaS platform while keeping private-key operations inside infrastructure they control.
Restricted networks
Use an outbound connection model for environments that should not expose inbound management services.
Operational consistency
Coordinate local execution through the same certificate, deployment, validation, and audit workflows.
Private key custody
Choose the custody boundary that fits the certificate.
Certificate management stays centralized while private-key handling can remain under the security controls appropriate for each workload.
SecuriTLS managed
SecuriTLS manages encrypted private-key material and the certificate lifecycle.
Satellite encrypted
Generate and encrypt private keys inside your environment before the encrypted key blob is stored by SecuriTLS.
HSM-backed
Keep private keys under HSM control and let the Satellite request cryptographic operations using a stored key reference.
HSM integration
Use existing key-management infrastructure.
KMIP
Generate RSA and ECDSA key pairs and perform signing through compatible KMIP servers.
RSA, ECDSA, and ML-DSA
Support RSA 2048, 3072, and 4096 and ECDSA P-256, P-384, and P-521, and ML-DSA 44, 65, and 87 HSM-backed keys.
Cosmian validated
SecuriTLS KMIP interoperability has been validated against Cosmian KMS. Other KMIP implementations may work when they provide the required operations and algorithms.
Satellite workflows
Run sensitive operations locally while keeping the platform informed.
Local key generation
Generate private keys in the satellite environment and return certificate requests or encrypted results.
CSR signing workflows
Coordinate signing through the satellite that holds or can access the relevant CA key material.
Credential protection
Encrypt deployment credentials for use by the intended satellite.
Certificate deployment
Write certificate, key, and CA materials to configured paths and run service reload commands.
Explore deployment automation →File validation
Inspect deployed certificate and key files in the customer environment.
TLS validation
Test live endpoints from the environment that can reach the target service.
Explore validation →Control plane and execution plane
Separate central coordination from local execution.
SecuriTLS platform
Stores workflow state, certificate records, job status, deployment intent, and audit history.
Customer satellite
Performs authorized local operations using customer-controlled access and encrypted material.
Target infrastructure
Receives certificate deployments and is validated from the appropriate network location.
Get started
Bring your certificate workflows into one place.
Start with a private CA and a few certificates, then expand into automation, deployment validation, audit history, and satellite workflows.