Your own certificate authority, ready in a minute.
Every tenant can run its own internal CA without buying an HSM, standing up OpenSSL scripts, or writing a CRL publisher. WeldForge generates the keys, issues end-entity certificates, publishes a signed CRL, answers OCSP queries, and tells you a month before a cert expires — all from the admin API.
What's included
Self-signed root CA
RSA-4096 keys, SHA-256 signature, BasicConstraints + KeyUsage + SKI/AKI set correctly. Private keys encrypted at rest via AES-GCM — the same envelope every other sensitive column uses.
Client cert issuance
RSA-2048 end-entity certificates with clientAuth + emailProtection EKU, SAN support, configurable validity, and single-reveal private keys returned exactly once to the caller.
CRL publication
Signed X.509 v2 CRLs at /t/{tenant}/pki/crl.pem. Every revocation bumps the CRL number, so relying parties can tell newer lists apart from older ones.
OCSP responder
RFC 6960 OCSP endpoint at /t/{tenant}/pki/ocsp. Returns GOOD, REVOKED (with reason and timestamp) or UNKNOWN — so your TLS terminators can check revocation without downloading a CRL.
Client cert authentication
Bind an issued certificate to a user. At login time, present the cert; WeldForge fingerprints it, verifies it's still active and untampered, and resolves the user automatically.
30 / 14 / 7 / 1-day notices
A scheduled job scans expiring certificates daily and emits audit events at 30, 14, 7 and 1 day before expiry. Subscribe to them via the webhook stream and pipe the notifications wherever your ops team lives.
Standards WeldForge speaks
- X.509 v3 end-entity certificates (RFC 5280)
- X.509 v2 CRLs with cRLNumber extension (RFC 5280 §5)
- OCSP with SHA-1 CertificateID (RFC 6960)
- PKCS #8 PEM for private keys, PEM / DER for certificates
- SHA-256 with RSA signatures by default (configurable on the CA row)