TrustBridge Managed
Connect securely to your customers' systems—without running a PKI of your own
An operating partner runs your TrustBridge installation: installation, updates, monitoring, and certificates. Your keys and approvals stay with your organization. Built for suppliers and mid-sized businesses whose customers require connections they can verify.
The challenge
Your customer wants to know which of your systems reach its data, and wants to be able to shut that access off at any time. VPN accounts and shared passwords don't answer that. But a certificate authority of your own takes people, a hardware security module, and practiced procedures—things a small IT team rarely has.
The solution
In the Managed model, an operating partner runs the installation within the scope agreed by contract: installation, security updates, monitoring, certificate renewal. Your organization agrees on the trust relationship with the customer, and people from your own team approve every manual certificate order with their own approval keys. The operating partner can prepare an issuance but cannot trigger one.
- No PKI team required: the operating partner handles installation, updates, monitoring, and certificate renewal.
- You stay in control: your certificate authority's keys live in an HSM assigned to your organization alone, and only your own people can approve.
- Narrow and revocable: each relationship covers specific services and purposes, and either side can revoke its direction at any time.
- No operator lock-in: a change of operator or model runs through a new CA generation, with no hand-over of private keys.
Two organizations, each with its own trust anchor
Each side keeps its own certificate authority. A relationship defines what applies in each direction; the connection is mutually authenticated TLS 1.3 plus an independently generated post-quantum secret.
Features
- Bilateral trust relationship with a policy per direction
- Mutually authenticated TLS 1.3 with an additional, independently generated post-quantum secret
- Hybrid certificates: existing relying parties keep verifying the classical signature
- Local TLS adapter: existing applications connect without code changes
- Certificates through ACME or EST, or after approval by a person
- Revocation lists generated ahead of time and distributed even without the database
Technical details
- Requirements: A customer or partner that uses TrustBridge or brings the anchor of its own enterprise PKI into the relationship. In your organization: people who approve manual orders, each with a personal hardware token, and custodians for the offline root. The scope, timeframes, and response times of operation are set by the contract with the operating partner. Operating models and requirements
Frequently asked questions
Who holds our keys?
Your organization. Your certificate authority's keys live in an HSM, or a dedicated HSM partition, assigned exclusively to your organization. The operating partner holds no approval keys and none of the key agents' secrets.
What does our customer need?
TrustBridge or its own enterprise PKI: it brings that PKI's anchor into the relationship and equips the systems involved with a TLS adapter and a key agent. Operating models
Can we switch operators later?
Yes. The switch runs through a new CA generation; no private keys change hands.
How do we connect our existing applications?
Through the local TLS adapter, with no code changes.
Setup, examples and reference, step by step: it's all in the documentation.
Open the documentation