Salesforce Encryption
Customer and opportunity data stay useful in Salesforce, without giving the CRM the last encryption key.
Automate TLS certificates
Issue, renew, deploy and revoke every machine identity from private, public and cloud CAs, with CA keys that stay in your vault, HSM or MPC cluster.
Stop outages
Expiry alerts by e-mail, Teams, Slack or webhook, and ACME renewal information so clients renew on time as lifetimes shrink towards 47 days.
Move faster
ACME, EST, SCEP, CMP and Kubernetes cert-manager give developers and devices certificates without a ticket.
Stay in control
M-of-N quorum on CA changes and revocation, access policies on every enrolment protocol, and CA keys that are never exported.
Every CA, in one hierarchy.
Run root and intermediate CAs on classical or post-quantum algorithms, and front the public and cloud CAs you already use, from one console.
- ML-DSA, SLH-DSA and a hybrid ML-DSA-65 + ECDSA-P256 composite next to RSA and ECC.
- Let's Encrypt, AWS Private CA, Azure Key Vault CA, Google CAS, Sectigo, DigiCert, QuoVadis and Cloudflare as external issuers.
Enrolment for every client, without a ticket.
Servers, devices, MDM and Kubernetes clusters enrol with the protocol they already speak, each endpoint bound to the CA you choose.
- ACME (RFC 8555) with renewal information, EST (RFC 7030), SCEP (RFC 8894) and CMP (RFC 4210 / 9483).
- A cert-manager issuer that signs Kubernetes CertificateRequests from the DuoKey CA.
Revocation answered in real time.
Per-CA OCSP responders and CRL distribution let gateways, browsers and back-ends refuse a revoked certificate the moment it is revoked.
- Revoke with RFC 5280 reasons from the console, the API or CMP.
- Responses signed in the same vault as the CA key.
CA keys that never leave the vault.
A CA created with a vault signs every certificate, CRL and OCSP response in that vault: an HSM, a cloud KMS or an MPC cluster. Nothing is exported.
- On-premises HSMs join through a PKCS#11 HSM agent next to your hardware.
- Software-held CAs can be migrated to a vault later.
F5 BIG-IP
FortiGate
Azure App Service
DuoKey Cockpit
cert-manager
IIS / Nginx / Apache
Java keystore
Certificate automation that reaches where they run.
Pick the target and the Cockpit deploys the certificate, validates it, rolls back on failure, then renews and redeploys before expiry.
- F5 BIG-IP, Fortinet FortiGate, Azure App Service and Entra ID.
- Apache, Nginx, IIS, Java keystores and Windows certificate stores.
Key features
CA lifecycle
Suspend, reactivate, cascading revoke and archive, with an impact preview before any cascading action.
Certificate templates
Reusable templates and a CSR approval workflow: request, approve or reject, issue.
Discovery and compliance
Network and agent-based TLS scanning, discovered-certificate import, Mozilla, NIST and PCI DSS checks.
Post-quantum ready
ML-DSA and SLH-DSA issuance and a hybrid composite for staged migrations.
Code signing
SignTool, JAR, Git and cosign signatures with non-exportable vault keys and approvals.
Device identity
EST and CMP provisioning for IoT and network fleets, in production at Volkswagen.
Deploy your PKI your way
Run the same Cockpit as a service, in your own data centre, or both, with CA keys wherever your policy requires.
Proof in practice
Where teams deploy this
Deep dives
Field guides for your programme
Compliance
Frameworks this product supports
Trust
Assurance and customer programmes
Customer programmes
Put every certificate on a schedule you control.
Talk to us about private CAs, ACME automation and post-quantum certificates.
Products
Related products
View product