TrustBridge Customer Managed

Your own infrastructure for trust between the companies in your supply chain

You run TrustBridge yourself: certificate authorities, HSMs, policies, and the relationships with your suppliers and partners. Built for enterprises and operators with their own security infrastructure. WKL supplies the software, updates, documentation, and the agreed support.

Schedule a call Go straight to the docs

Two organizations, each with its own certificate authority, joined by a relationship and TLS 1.3 with a post-quantum secret

The challenge

Suppliers, service providers, and maintenance contractors reach your systems through VPN accounts, shared networks, and hand-maintained exceptions. With every new partner, it gets harder to say who may access what, why, since when—and how to shut it off again. Meanwhile, NIS2 requires covered entities to govern the security of their supplier relationships, and the EU's coordinated roadmap names PKI among the uses that should move to quantum-safe algorithms by the end of 2030.

The solution

Each organization runs its own certificate authority. Two organizations agree on a relationship that is limited in scope, tied to a purpose, and revocable at any time. Their systems authenticate each other with certificates and open a TLS 1.3 connection that an independently generated post-quantum secret also protects. Signing happens in exactly one place: only with keys in the HSM, and only for orders that an authorized person approved cryptographically or that enrollment confirmed.

Trust is never passed on: every relationship is agreed between exactly two organizations and defined separately for each direction.
A database breach isn't enough: a compromised database, web front end, or management application cannot get a certificate issued.
Evidence for auditors: every manual issuance is tied to a person, and a tamper-evident ledger with an external anchor shows which approvals it rests on.
Protection against later decryption: anyone recording traffic today would later have to break both the TLS key exchange and the additional post-quantum secret.

Two organizations, each with its own trust anchor

Each side keeps its own certificate authority. A relationship defines what applies in each direction; the connection is mutually authenticated TLS 1.3 plus an independently generated post-quantum secret.

Architecture: your own certificate authority and application, a relationship and TLS 1.3 to the partner system — Customer Managed: you run all of it yourself – certificate authorities, HSMs, policies, and relationships.

Features

A namespace of its own per partner: no partner can obtain identities in another partner's namespace
Hybrid certificates with a classical and a quantum-safe signature
ACME, EST, and CMP, plus a documented management API
Local TLS adapter for existing applications, without code changes
Revocation lists generated ahead of time: a revocation takes effect even when online services are disrupted
Works with Managed installations and existing enterprise PKIs (Federated Hybrid)

Technical details

Requirements: An HSM with non-exportable keys for ML-DSA and the classical algorithms, roles and quorum for administrative operations, a signature counter per key, and certification to FIPS 140-3 or Common Criteria. Plus custodians for the offline root, approvers with personal hardware tokens, and operating procedures of your own. System architecture and requirements

Frequently asked questions

What do our partners need?

TrustBridge or their own enterprise PKI: they bring that PKI's anchor into the relationship and equip the systems involved with a TLS adapter and a key agent. Operating models

Can our suppliers use the Managed model?

Yes. Managed and Customer Managed installations trust each other directly; the operating partner sets up the supplier's side, and the supplier grants the approval.

How does TrustBridge support NIS2 and ISO 27001 evidence?

The documentation maps TrustBridge's functions to the requirements of NIS2, BSI TR-02102, and ISO 27001—for example, every manual issuance tied to a named approver, and the tamper-evident ledger with its external anchor. That shows your auditors which evidence TrustBridge provides; assessing your organization stays with them.

Where do I start?

With the case study: one supplier, from agreement to the end of the cooperation, with each party's responsibilities. Case study: onboarding a supplier

Setup, examples and reference, step by step: it's all in the documentation.

Open the documentation