Glossary

Summary. Definitions of the technical terms used in this documentation. Where a term comes from a standard, the source is given.

Overview

Term	Meaning
ACME	Automatic Certificate Management Environment, a protocol for automated issuance (RFC 8555)
Additional post-quantum secret	A secret that the key agents agree on independently of TLS and that enters every relationship connection as an external PSK
Agent certificate	ML-DSA certificate with which a key agent authenticates itself to the agent on the other side (RFC 9881)
AIA	Authority Information Access; an extension stating where the issuing CA's certificate can be retrieved (RFC 5280)
Alternative signature	A second signature in a certificate, per the X.509 extensions `2.5.29.72` to `2.5.29.74`; here ML-DSA
Approval	A signature over the order hash by a person registered in the rule set
Attestation	Confirmation of an order by enrollment with its service key; replaces approval by a person in automatic profile classes
Authorization	A target application's decision whether a specific operation is allowed for a verified identity
CA generation	A set of CA keys and certificates with its own lifetime; a new generation supersedes the previous one
CDP	CRL Distribution Point; an extension stating where the CRL can be retrieved (RFC 5280)
Ceremony	A documented procedure with fixed roles at the offline root
CMP	Certificate Management Protocol; profile for devices: RFC 9483
Connection rotation	Scheduled replacement of a TLS connection by a new one with a fresh secret, without interruption for the application
CRL	Certificate Revocation List (RFC 5280)
CSR	Certificate Signing Request per PKCS #10, with proof of possession
EST	Enrollment over Secure Transport (RFC 7030)
Evidence chain	Mapping of every requirement to source, target, commitment, measure, component, and verification procedure
External anchor	A copy of a chain head in append-only storage outside the administrators' reach
External PSK	A secret agreed outside TLS that enters the TLS 1.3 key schedule (RFC 8446)
Fail closed	Rejecting rather than accepting when status information is missing
HSM (hardware security module)	Hardware that generates, stores, and uses keys without releasing them
Hybrid	Combination of a classical and a post-quantum mechanism
Hybrid group	Key agreement in TLS 1.3 combining ECDHE and ML-KEM (RFC 10024)
Issuing CA	A CA that issues system certificates; at least one per organization or partner, with a name constraint
Key agent	A service on a connected host that agrees on the additional post-quantum secret with the agent on the other side
Key broker	A local component that hands the key agent's secret to the TLS adapter on the same host
`KeyUpdate`	TLS 1.3 message for deriving new traffic keys from the current traffic secret
Ledger	The CA worker's append-only, chained journal of intents, issuances, rejections, revocations, and relationships
ML-DSA	Module-Lattice-Based Digital Signature Algorithm (FIPS 204)
ML-KEM	Module-Lattice-Based Key-Encapsulation Mechanism (FIPS 203)
mTLS	TLS with mutual certificate authentication
Name constraint	The `nameConstraints` extension in a CA certificate (RFC 5280, Section 4.2.1.10)
OCSP	Online Certificate Status Protocol (RFC 6960); not offered by TrustBridge
OData	Open Data Protocol, a standard for REST interfaces (OASIS, ISO/IEC 20802)
Operating partner	A company that operates an installation to the agreed extent in the Managed model, without holding approvals or keys
Order	An immutable, byte-exact snapshot of a future certificate, revocation, or relationship; identified by the SHA-256 of its bytes
Organization	A party with its own hierarchy of certificate authorities, its own approvers, and its own ledger
Partner	An organization in the supply chain, represented technically by its issuing CA
Partner identity	The combination of organization, service name, and relationship of a connection, as verified by the TLS adapter
Partner portal	Web interface through which the people responsible at a partner with its own partner CA submit and approve requests
Profile class	A certificate category defined in the worker's rule set, with binding rules
Profile template	A template maintained in management from which an order is created
Projection	A copy of a ledger entry in the database, for display; not authoritative
Relationship policy	An organization's settings for its direction of a trust relationship: services, purpose, cryptographic requirements, duration, right to change, revocation
Relationship revocation	Unilateral termination of one direction of a trust relationship
Relying-party contract	Rules a relying party must follow for the security commitments to hold for it
RPO, RTO	Maximum tolerable data loss and maximum tolerable recovery time, respectively
Rule set	The CA worker's local configuration: CAs, profile classes, approvers, limits
Security commitment	A verifiable statement about the behavior of the overall system, with assumptions, verification procedure, and residual risk
SLH-DSA	Stateless Hash-Based Digital Signature Algorithm (FIPS 205)
SPIFFE	Secure Production Identity Framework for Everyone; a standard for workload identities
Standby	A prepared second instance that takes over on failure
System	A partner's host, service, or device, identified by exactly one DNS name
Tenant	The dividing line between organizations and partners within one installation
TLS adapter	A local service that opens or accepts the protected TLS connection to the other side on behalf of an existing application
`tls_cert_with_extern_psk`	TLS 1.3 extension from RFC 9973: certificate authentication with an additional external PSK in the key schedule
Trust anchor	A certificate that a relying party trusts without further verification
Trust bundle	A compilation of the active relationships with their anchors and policies, signed by the CA worker
Trust relationship	An agreement between exactly two organizations to recognize the other side's trust anchors for specific services and purposes
Trusted computing base (TCB)	Components whose compromise enables unauthorized issuance or status statements
Visibility scope	A named set of tenants whose data a person may see