System architecture

Summary. This page describes the components of a TrustBridge installation, how they connect, and a security profile for each component: task, security boundary, required rights, explicitly forbidden capabilities, proof of identity, data flow and key access, behavior on failure and compromise, recovery and audit, and remaining risks. An installation has two parts: the certificate authority with management, enrollment, and distribution at a central location of the organization, and the endpoint components (key agent, key broker, and TLS adapter) on every connected host.

Terms

Trusted computing base (TCB) – the set of components whose compromise allows an unauthorized issuance or status statement.
Order – an immutable snapshot, stored byte for byte, of a future certificate, a revocation, or a relationship policy; its identifier is the SHA-256 of its bytes.
Ledger – the CA worker's append-only, chained journal of intents, issuances, rejections, revocations, and relationships.
Rule set – the CA worker's local configuration file: allowed CAs and profile classes, approvers, lifetimes, permitted content.
Trust bundle – a compilation, signed by the CA worker, of an organization's active relationships with their trust anchors and policies; TLS adapters and key agents accept only bundles with a valid signature.
Projection – a copy of a ledger entry in the database for display; not authoritative.

Diagram conventions

All diagrams use the same visual language.

Element	Meaning
Red fill	Trusted computing base: compromising it allows unauthorized issuance
Gray fill	Online services and storage outside the trusted computing base
Dark gray fill	Component operated offline
Blue fill	Parties and systems outside TrustBridge
Green fill	Additional post-quantum protection layer
Yellow fill	Authorization decision of the target application
White box with border	Organization or zone
Solid arrow `-->`	Flow of data or orders, direction in which a connection is opened
Dashed arrow `-.->`	Transfer outside the regular data path (ceremony, exchange of trust anchors, second path)
Double arrow `==>`	Cryptographic operation or hand-over of a cryptographic result (signature, approval, key)

Overview and network directions

graph TD
  subgraph Z1 [Zone partners and relying parties]
    PS[Partner systems]
    PR[Relying parties]
    PP[Partner approvers]
  end
  subgraph Z2 [Zone online services]
    AD[Protocol adapters<br/>ACME, EST]
    EK[Enrollment core<br/>attestation]
    VW[Management<br/>management API]
    PO[Partner portal]
    VT[Distribution<br/>AIA, CDP, trust bundles]
  end
  subgraph Z3 [Zone data]
    DB[(SQL Server)]
  end
  subgraph Z4 [Zone signing, no inbound]
    WK[CA worker]
    HSM[HSM]
    REG[(Ledger)]
  end
  subgraph Z5 [Zone operations]
    ADM[Management application]
    ANK[(External anchor<br/>append-only)]
    ART[(Artifact store<br/>second path)]
  end
  subgraph Z6 [Offline]
    RT[Root CA]
  end
  subgraph Z7 [Connected host]
    TLA[TLS adapter]
    SA[Key agent and<br/>key broker]
  end
  PS -->|HTTPS| AD
  PP -->|HTTPS| PO
  AD --> EK
  EK -->|order| DB
  ADM -->|HTTPS| VW
  PO --> VW
  VW -->|SQL| DB
  WK -->|outbound: reads, writes| DB
  WK ==>|signs| HSM
  WK --> REG
  WK -->|outbound| ART
  WK -->|chain head| ANK
  DB --> VT
  ART --> VT
  PR -->|HTTP GET| VT
  TLA -->|CRLs, trust bundles| VT
  SA -->|renewal via ACME or EST| AD
  RT -.->|ceremony| WK
  classDef tcb fill:#fde7e9,stroke:#a4262c,color:#201f1e
  classDef onl fill:#f3f2f1,stroke:#605e5c,color:#201f1e
  classDef off fill:#e1dfdd,stroke:#323130,color:#201f1e
  classDef par fill:#deecf9,stroke:#0078d4,color:#201f1e
  classDef pq fill:#dff6dd,stroke:#107c10,color:#201f1e
  class WK,HSM,REG,EK tcb
  class AD,VW,PO,VT,DB,ANK,ART,TLA onl
  class RT off
  class PS,PR,PP,ADM par
  class SA pq
  style Z1 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z2 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z3 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z4 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z5 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z6 fill:#ffffff,stroke:#8a8886,color:#201f1e
  style Z7 fill:#ffffff,stroke:#8a8886,color:#201f1e

Notation	Meaning
Red	Trusted computing base; the enrollment core belongs to it only for automatic profile classes
Gray	Online services and storage outside the trusted computing base
Green	Post-quantum protection layer on the connected host
Arrow direction	Direction in which the connection is opened; the CA worker opens outbound connections only
Arrow types	Solid: flow of data and orders; dashed: outside the regular data path; double: cryptographic operation

Process and account separation. In a small installation, management, partner portal, enrollment, and distribution may run in one process. The CA worker never does: it shares neither process nor operating system account with any service that accepts HTTP. Every service signs in to the database with its own login, which holds rights only to the tables it needs.

Deployment variants

Variant	Layout	Suited for
Small	Host 1: management, partner portal, enrollment, and distribution in one process, plus the database; host 2: CA worker with HSM, outbound connections only; root offline	Small operations without high availability, a supplier in the Managed model
Standard	Enrollment and partner portal in a perimeter zone, management in the internal network, distribution with several instances, a dedicated database server, CA worker and HSM each with a standby, external anchor and artifact store kept separate	Production operation at a customer

In both variants, the TLS adapter, key agent, and key broker run on every connected host, or on a host in front of it within the same protected network segment. Separating process and operating system account between the CA worker and HTTP services is mandatory; a dedicated host for the worker is recommended.

Trust transitions

From	To	Mechanism	What is checked
Partner system	Protocol adapter	TLS; ACME account bound to the tenant, or EST with a client certificate	The request is unverified input; proof of possession, namespace, profile class
Management application, partner portal	Management API	HTTPS; personal key, second factor	Permissions per request; approvals are only passed through
Management, enrollment	Database	One login per service	Permissions per table; for the worker the content is unverified input
Database	CA worker	Outbound connection from the worker	Approvals against public keys in the rule set; all rules of the profile class or the relationship
CA worker	HSM	Session with a PIN from the operating system's secret store	Keys by fingerprint in the rule set
Offline root	CA worker	Media from the ceremony	Fingerprint against the ceremony record
CA worker	Distribution	Signed artifacts over two paths	Signature, increasing CRL and bundle numbers
Distribution	Relying party, TLS adapter	Plain HTTP is sufficient	Authenticity comes solely from the signature on CRL and trust bundle
Key agent	Key agent on the other side	Dedicated protocol over TLS	ML-DSA agent certificate against the relationship's anchor in the trust bundle
Key broker	TLS adapter	Local operating system interface	Access only for the adapter's account

Data access

Service	Reads	Writes	Signs
CA worker	Orders, approvals, cancellations, revocation orders, relationship orders	Projections, CRLs, trust bundles, system status	Yes, in the HSM
Management	Master data, profile templates, orders, relationships, projections	Master data, profile templates, orders, relationship orders, passed-through approvals, cancellations, revocation orders, access management	No
Partner portal	Through management, limited to the partner's tenant	Requests and approvals by the partner's approvers	No
Enrollment	Profile templates, its own orders, projections	Requests, orders, attestations	Attestations only
Distribution	Pre-signed CRLs, CA certificates, and trust bundles	Nothing	No
Management application	– (only through management)	–	Approvals with a personal key
Key agent	Trust bundle, its own agent certificate	Secrets, only into the host's memory	Only its own key exchange

Security profiles of the components

CA worker

Attribute	Definition
Task	Check and execute orders, generate serial numbers, sign, keep the ledger, produce CRLs and trust bundles, report system status
Security boundary	Trusted computing base, together with its host, account, clock, rule set, and ledger
Required rights	Read the order tables, write projections; access to the HSM; outbound connections to database, artifact store, and anchor
Forbidden	Inbound network connections; sharing process or account with an HTTP service; signing without a valid approval or attestation; deriving content from profiles
Identity	Startup check: fingerprint and non-exportability of every CA key against the rule set; exclusive file lock on the ledger (exactly one active worker per CA)
Data flow, keys	Reads orders as unverified input; keys only as references into the HSM; PIN in the operating system's secret store
Failure behavior	The intent is written to the ledger before signing; after a crash the worker re-signs the same intent with the same serial number; a certificate leaves the worker only after the result entry. Poison orders end as a rejection after a maximum number of attempts. Permanent errors (rule violations) are rejected immediately, transient ones (database) are retried
Compromise	An attacker can issue within the scope of the keys present in the HSM; countermeasure: revocation of the CA by the root, detection by reconciling the HSM's signature counters against the ledger
Recovery	Standby worker with its own HSM access; after the ledger is restored, it takes over projected certificates with a valid CA signature before processing new orders
Audit	Ledger with a hash chain; chain head to the external anchor and into every ceremony
Residual risk, controls	The worker host's administrator can change the rule set: four-eyes principle and a checksum of the rule set in the ledger; physical and logical access protection

HSM

Attribute	Definition
Task	Generate, hold, and use CA keys
Security boundary	Trusted computing base
Requirements	Non-exportable keys for ML-DSA and the classical algorithms; roles and quorum for administrative operations; a signature counter per key; certification to FIPS 140-3 or Common Criteria
Forbidden	Exporting CA keys; software keys for a CA
Identity	Keys bound by fingerprint in the rule set; one key belongs to exactly one CA
Failure behavior	An outage counts as a worker outage; standby HSM. Backup only through the HSM's own mechanism under a multi-person rule; replacing the HSM changes only the reference, not the key
Compromise	The key counts as compromised; for the procedure see Operations and emergencies

Offline root

Attribute	Definition
Task	Root key; signing name-constrained issuing CAs; the root's CRL; revoking issuing CAs
Security boundary	Trusted computing base, permanently without network
Forbidden	Network connection; signing content from the online system without confirmation over a second channel
Identity	Ceremony roles: lead, custodian, witness; two safes
Data flow	In: only the issuing CA's CSR, the ceremony order, a CA revocation order; out: only the CA certificate, root certificate, root CRL, public part of the record
Audit	Its own ledger; a record of every ceremony

Management (management API)

Attribute	Definition
Task	Counterpart of the management application, the partner portal, and automation: maintain master data and profile templates, create orders as snapshots (parse CSRs, encode extensions), create and change relationships, pass approvals through, cancel, file revocation orders, inventory, access management
Security boundary	Outside the trusted computing base
Required rights	Its own database login with rights to master data, orders, relationships, access management
Forbidden	Signing; access to the HSM; causing an order to be executed; vouching for approvals
Caller identity	Personal key plus a second factor for every person; for programs, mTLS with certificates from the organization's own CA
Failure behavior	An outage prevents management, but not issuance in automatic classes, not status information, and not existing relationships
Compromise	An attacker can propose and cancel orders, trigger revocations, and read tenant data; they cannot issue and cannot put a relationship into force, because the approval keys are not within reach
Audit	Every permission change in one transaction together with its audit entry

Partner portal

Attribute	Definition
Task	Web interface for the people responsible at a partner with a partner CA in the customer's hierarchy: file requests, approve their own orders, view inventory and revocation status of their own namespace, trigger revocation
Security boundary	Outside the trusted computing base
Forbidden	Access to other tenants; approval for another namespace; holding approval keys on the server
Identity	Personal key plus a second factor; the person signs approvals with their own hardware token in the browser or in a local helper program
Compromise	Like management, limited to the tenants whose people it is currently serving

Enrollment and protocol adapters

Attribute	Definition
Task	Accept requests via ACME and EST, verify requesters, create orders; attest automatic profile classes
Security boundary	Outside the trusted computing base; for automatic classes the enrollment core with its attestation key belongs to it
Forbidden	Signing within the call or waiting for a certificate; attesting manual profile classes; generating private keys (EST `serverkeygen`)
Compromise	Issuance only in automatic classes, within the namespace of the partner concerned, with a short lifetime; never CA certificates, never other tenants

Distribution

Attribute	Definition
Task	Serve CA certificates (AIA), CRLs (CDP), and trust bundles over HTTP
Forbidden	Holding a private key; write access to CA data
Failure behavior	Verifies every signature before serving, serves the highest valid number, keeps the most recently read artifacts available
Compromise	Can serve an older CRL or bundle that is still valid; cannot forge one
Recovery	Designed for high availability (several instances)

Database

Attribute	Definition
Task	Shared data: master data, orders, relationships, projections, access management, security audit log
Security boundary	Explicitly outside the trusted computing base
Tenant separation	Tenant as a foreign key in every tenant-scoped table, row-level security per service login
Forbidden	Private keys; approvers (they live in the rule set)
Compromise	Delay and disclosure; no issuance, no un-revocation, no relationship

Management application

Attribute	Definition
Task	User interface for the staff of the organization and its operating partner (system administration, partner management, support)
Forbidden	Database connection; any key material other than the signed-in person's personal approval key
Particular feature	Displays an order from exactly the bytes whose hash the person signs, and checks the hash itself

TLS adapter

Attribute	Definition
Task	Inbound and outbound TLS 1.3 connections for a local application; mutual authentication per the relying-party contract; enforcing the relationship policy; feeding in the external PSK; passing the partner identity to the application; connection rotation
Security boundary	Outside the certificate authority's trusted computing base; the security boundary of the connected host
Required rights	Its own service account; read access to its own service key; access to the key broker's local interface
Forbidden	Connections without a PSK where the relationship requires one; accepting connections from anchors outside the trust bundle; session resumption and 0-RTT for relationship connections
Failure behavior	Without a valid trust bundle or a valid CRL, no new connections; every rejection is logged with its reason
Compromise	An attacker can read this host's connections and speak in its name until the service certificate or agent certificate is revoked
Audit	Connection log with partner identity, relationship, outcome of the checks, and connection duration

Key agent and key broker

Attribute	Definition
Task	Post-quantum key exchange with the other side's agent, renewal on the relationship's schedule, hand-over of the secret to the local TLS adapter, renewal of its own agent certificate
Security boundary	The security boundary of the connected host
Forbidden	Passing secrets to another host; writing secrets to storage; exchanging with an agent outside the trust bundle
Identity	ML-DSA agent certificate from the organization's own CA
Failure behavior	If the other side is unreachable, valid secrets remain usable until they expire; after that, no new connections
Compromise	The secrets of this host's connections; revoking the agent certificate ends all of the host's key exchanges
Audit	Log of every exchange with counterpart, relationship, and outcome, without key material

What this page does not define

A specific HSM. The requirements are listed above; any HSM that meets them is acceptable.
The permissions of connected applications. The TLS adapter hands them the verified identity; the decision stays with them.
Identity provisioning for short-lived workloads inside a data center (such as SPIFFE).