Run your own internal Certificate Authority.

Yes, and it's the most common starting point. TigerTrust supports cross-certification with Microsoft ADCS, EJBCA, OpenSSL-based CAs, and legacy Symantec/DigiCert internal roots. We issue a fresh root inside your new HSM, cross-sign against your existing chain so trust never breaks, migrate templates and issued certificates over a defined window, then decommission the old CA. Typical timeline is 60-90 days for a mid-size estate.

HSM keys back up as M-of-N wrapped shards using the HSM vendor's native ceremony (Thales SKS, nShield ACS, etc.). TigerTrust automates the operator prompts, records the ceremony to the audit log, and stores the wrapped shards where you specify — including offline media for offline root CAs. Recovery is documented per HSM vendor and tested during onboarding. We never hold the recovery quorum.

Full X.509 v3 with any extension you can express — TLS server, TLS client, code signing, S/MIME, user auth, smart card logon, device certificates, and custom OID-based extensions. Templates enforce key algorithms (RSA, ECDSA P-256/P-384, Ed25519), key sizes, validity periods, EKU sets, and name constraints. Custom policy OIDs and CP/CPS references are managed through the same UI. RFC 5280 conformance is validated at issuance.

The TigerTrust platform is SOC 2 Type II certified. For customers building a publicly-trusted CA hierarchy, we support the operational controls required for WebTrust for CAs and ETSI EN 319 411 — including offline root storage, key ceremony recording, dual-control enforcement, and audit trail integrity. We do not perform the WebTrust audit itself; that's done by your accredited auditor against the platform we operate.

Yes. TigerTrust PKI Core deploys as a Kubernetes application or bare-metal binaries. Fully air-gapped deployments are supported with signed offline update bundles and offline root ceremonies. The control plane can be self-hosted; the offline root can live in a physically isolated environment and only come online for signing intermediate CA renewals. A hybrid model — SaaS control plane, on-prem HSMs — is also common.