CryptOS-PKI
A PKI operating systemwith no shell to break
Every CryptOS image is built from tested source, shipped unsigned, and signed only when you boot it, so you hold the keys, not us.
$ cryptosctl identity show
role issuing-ca
status active -- TPM-sealed
chain valid -- 2 intermediates
api mTLS gRPC -- no shell, no SSHWhat it is
An operating system built around one job: being a trust
No login prompt, no package manager, no general-purpose shell -- just the PKI API.
Immutable rootfs
A read-only SquashFS image. State lives only in an encrypted partition unsealed by the local TPM.
TPM-bound keys
Private keys are wrapped by the TPM and never touch disk in the clear.
Declarative config
Roles, hierarchy and issuance policy are version-controlled YAML applied over the API.
No interactive access
No SSH, no shell, no usernames or passwords. Every change goes through mTLS gRPC.
Trust model
Tested source, unsigned images, your
We publish and test the source. You decide who signs what runs.
CryptOS ships unsigned images built from source you can read and test yourself. Secure Boot enrollment, image signing and the keys behind them stay with you: nothing in the chain of trust for your fleet is signed by us.
FleetOS Manager
One view across every linked
An optional web console for day-to-day operations -- the nodes keep working without it.
Link a node to the FleetOS Manager for topology, certificate inventory and ceremony history across your fleet. The manager never holds issuance authority -- its own certificate can't sign.
Standards
Built to the PKI
X.509, OCSP, time-stamps, ACME, EST and SCEP.
Your time-stamp policy is yours: its OID sits under your own IANA Private Enterprise Number. Get a TSA policy OID