BlogSupportDocumentation
TigerTrust
PKI as a Service

Deploy enterprise PKI in minutes, not months.

Cloud-hosted, fully managed Certificate Authorities with HSM-backed keys, ACME, and multi-tenant isolation. No infrastructure to run, no PKI specialists to hire, no per-cert public CA fees.

Request a demoTalk to sales
IssuanceEngine
cURL
ACME
REST
K8s
Terraform
Webhook
12,847 certs issued today
From zero to signing

Provision a CA. Wire up ACME. Ship certificates.

Four steps from empty account to production certificate issuance — every stage backed by HSMs and audit trails.

Provision a CA hierarchy in minutes

Spin up a root CA and issuing CAs from a template. Keys generate inside FIPS 140-2 Level 3 HSMs and never leave — no key ceremony spreadsheet required.

  • Root + intermediate hierarchy templates
  • HSM-backed key generation
  • Choose region for data residency
  • Automatic OCSP responder deployment
Cloud PKI provisioning console
Fully managed

Cloud-hosted CA with HSM-backed keys

Root and intermediate CAs run in our infrastructure with FIPS 140-2 Level 3 HSMs. We handle HSM lifecycle, backups, HA, and security patching — you consume certificates.

How it works
  • Root and intermediate CA hierarchies
  • HSM-backed key storage (FIPS 140-2 L3)
  • 99.99% availability SLA
  • Automated backups and DR
Cloud-hosted certificate authority infrastructure
API-first

Automated provisioning via ACME and REST

Standard enrollment protocols first-class. ACME for TLS, EST/SCEP for devices, REST APIs and SDKs for everything else. Terraform and Kubernetes operators for infra-as-code.

How it works
  • ACME protocol support
  • REST API and SDKs
  • Self-service developer portals
  • Terraform provider and Kubernetes operators
ACME and REST API integration
Multi-tenant

Isolated environments for teams and business units

Each tenant gets its own CA hierarchy, policies, and RBAC boundary. Delegated administration lets you offer PKI to internal teams — or external customers as an MSP.

How it works
  • Department and team isolation
  • Delegated administration
  • Per-tenant policies and CAs
  • White-label support for MSPs
Multi-tenant PKI environments
Global footprint

Deploy close to your workloads

Multi-region deployment with data-residency options for regulated industries. Edge CRL and OCSP responders keep certificate validation fast in every region.

How it works
  • Multi-region deployment
  • Data residency options
  • Edge CRL/OCSP responders
  • Sub-50ms validation worldwide
Global PKI infrastructure
Everything a PKI needs — nothing to manage

Enterprise PKI. Without the complexity.

The full PKI stack, delivered as a service.

Deploy in minutes
Production-ready CA hierarchy in under 10 minutes, not months of key ceremonies.
  • Templated CA hierarchies
  • One-command deploy
  • Instant OCSP responders
Zero infrastructure to run
HSMs, backups, HA, and patching handled by TigerTrust.
  • Managed HSMs
  • Automated backups
  • Zero-downtime upgrades
Bank-grade security
FIPS 140-2 Level 3 HSMs, SOC 2 Type II certified, RBAC enforced.
  • FIPS 140-2 L3 HSMs
  • SOC 2 Type II
  • Role-based access control
Predictable pricing
Simple per-certificate pricing with no hidden infrastructure costs.
  • Per-certificate model
  • Volume discounts
  • No infrastructure fees
DevOps friendly
ACME, REST APIs, and integrations for every CI/CD and infra tool.
  • ACME for TLS
  • Terraform provider
  • K8s cert-manager
MSP-ready
White-label PKI with per-customer CAs and billing integration.
  • Per-customer CAs
  • White-label branding
  • Usage-based billing

From production PKIaaS deployments

< 10min
Time to first CA
99.99%
Uptime SLA
< 50ms
Issuance latency
Case study
Top-100 · Healthcare

First internal CA issued in under 8 minutes — replaced a 9-month ADCS project.

“We'd scoped a nine-month project to stand up a HIPAA-grade internal CA. TigerTrust had our root and two intermediates signing in an afternoon. That budget went elsewhere.”
— VP, Security Engineering
8min
Time to first signed certificate
99.99%
CA uptime across 18 months
3
PKI engineers no longer needed to hire
Integrations

Works with every tool in your stack

Managed CAs that speak the enrollment protocols and identity systems your platforms already use.

AWS CloudHSM
HSM
Azure Dedicated HSM
HSM
Thales Luna
HSM
Okta
Identity
Azure AD
Identity
Google Workspace
Identity
cert-manager
K8s
Istio
K8s
Terraform
IaC
HashiCorp Vault
Secrets
ServiceNow
ITSM
Datadog
Monitoring
Explore all integrations
FAQ

Frequently asked questions

Under 10 minutes for a full CA hierarchy. Sign up, pick a region for data residency, choose a hierarchy template (single root, two-tier, three-tier), and TigerTrust provisions the root and issuing CAs inside FIPS 140-2 Level 3 HSMs. ACME, EST, SCEP, and REST endpoints are live immediately. Wire up cert-manager or your ACME client and you have signed certificates in the same session.
Inside FIPS 140-2 Level 3 HSMs operated by TigerTrust in your chosen region. Keys generate inside the HSM, sign inside the HSM, and never leave — TigerTrust operators cannot extract them and neither can we. HSM audit logs are streamed to your tenant. If you need BYOK or a dedicated HSM partition for regulatory reasons, that's available on the Enterprise plan.
ACME v2 (HTTP-01, DNS-01, TLS-ALPN-01) for TLS certificates and cert-manager. EST (RFC 7030) for enterprise device fleets. SCEP for legacy device management. REST APIs and SDKs (Python, Go, Java, Node.js) for anything custom. A Kubernetes Issuer/ClusterIssuer for cert-manager and a Terraform provider for infrastructure-as-code round out the toolkit. Same CA, every protocol.
Yes. TigerTrust can host intermediate CAs that chain to your existing offline root — your root stays air-gapped, we operate the issuing CAs. Alternatively, cross-certification lets a TigerTrust root be trusted alongside an existing internal root during a migration window. For fully-external trust anchors (public CAs, government roots), we support subordinate CA hosting under your chain.
A base platform fee for the tenant plus per-certificate pricing that includes issuance, renewal, revocation, OCSP, and CRL serving. Volume discounts kick in at 100k, 500k, and 1M+ managed certificates. HSM partitions, dedicated regions, and offline-root hosting are add-ons. There is no per-API-call charge and no bandwidth billing — you can hit the ACME endpoint as hard as you need.
SOC 2 Type II, ISO 27001, and PCI DSS attestations for the TigerTrust platform. HIPAA-eligible under a BAA. FedRAMP Moderate authorization in progress. HSM operations are audited to FIPS 140-2 Level 3. For customers building publicly-trusted or ETSI-audited CAs, the platform provides the operational controls (dual control, ceremony recording, immutable audit) that your accredited auditor needs.
Related resources

Continue exploring

Product

Enterprise PKI Management

Prefer to self-host? Same PKI Core, on your infrastructure.

Read more
Product

Kubernetes CLM

Wire PKIaaS into every cluster via cert-manager and service mesh.

Read more
Solution

PKI modernization

Retire ADCS, legacy EJBCA, and OpenSSL scripts — with zero-downtime migration.

Read more
Solution

Cloud-native

PKI patterns for platform teams running on Kubernetes and multi-cloud.

Read more

Get an enterprise CA. Skip the infrastructure.

Request a demoTalk to sales