An immutable, API-driven PKI operating system™
Your own certificate authority, on a PKI OSwith no shell to break into.
CryptOS turns a bare machine into an immutable, API-driven certificate authority: no shell, no login, no door in except the API. Every image is built from tested source and signed only when you boot it, so you hold the keys, not us.
$ cryptosctl identity showsubject CN=Example Issuing CAissuer CN=Example Root CAchain 3 certificates$ cryptosctl identity validateOK: certificate chain validates
What it is
An operating system built around one job: being a trust
No login prompt, no package manager, no general-purpose shell -- just the PKI API.
Immutable rootfs
A read-only SquashFS image. State lives only in an encrypted partition unsealed by the local TPM.
TPM-bound keys
Private keys are wrapped by the TPM and never touch disk in the clear.
Declarative config
Roles, hierarchy and issuance policy are version-controlled YAML applied over the API.
No interactive access
No SSH, no shell, no usernames or passwords. Every change goes through mTLS gRPC.
Trust model
Tested source, unsigned images, your
We publish and test the source. You decide who signs what runs.
CryptOS ships unsigned images built from source you can read and test yourself. Secure Boot enrollment, image signing and the keys behind them stay with you: nothing in the chain of trust for your fleet is signed by us. See every control in the Trust Center
FleetOS Manager
One view across every linked
An optional web console for day-to-day operations -- the nodes keep working without it.
Link a node to the FleetOS Manager for topology, certificate inventory and approvals across your fleet. The manager never holds a CA key: the node that holds the CA issues and revokes, and the manager only carries the request. How FleetOS Manager works
Standards
Built to the PKI
X.509, OCSP, time-stamps, ACME, EST and SCEP.
Your time-stamp policy is yours: its OID sits under your own IANA Private Enterprise Number. Get a TSA policy OID