stor·ax

Products / Storax CA

The certificate authority built for the post-quantum decade.

Storax CA issues ML-DSA and SLH-DSA certificates today — with the enrollment protocols, lifecycle automation, and HSM integration your infrastructure already expects from a modern private CA.

Request a demo Explore the product

Why post-quantum

“Harvest now, decrypt later” is already happening.

Certificates issued today with classical algorithms will still be trusted when cryptographically relevant quantum computers arrive. Migrating a PKI takes years — the root you create this quarter should already be quantum-safe. Storax CA makes post-quantum the default, not a roadmap item.

Post-quantum by default

ML-DSA (FIPS 204) is the primary signature family for every issuance path. SLH-DSA (FIPS 205) is offered for long-lived roots where conservative, hash-based security matters most.

Full classical interop

ECDSA P-256/P-384, Ed25519, and RSA keep today's clients working. Post-quantum is the default we recommend — but your existing fleet enrolls as it is, and migrates on your schedule.

A new CA, with no legacy

Not a fork, a wrapper, or a decades-old codebase with post-quantum bolted on. A certificate authority designed from a clean sheet for the PQ era — quantum-safe algorithms as first-class citizens.

Lightning fast, by construction

A native engine written in modern C++ — no interpreter, no runtime, no garbage collector between a request and a signature. One lean binary that issues at wire speed, even with larger post-quantum keys and signatures.

Standards-clean X.509

Serials from a CSPRNG, RFC 5280-correct key identifiers, validated distinguished names, and conformance-tested DER — verified against independent implementations.

Product

Everything a private CA should do — in one deployment.

A complete issuance platform: REST API, standards-based enrollment, revocation distribution, a web console, and a CLI. One binary, your choice of SQLite or PostgreSQL behind it.

EST enrollment (RFC 7030)

Algorithm-agnostic enrollment that devices and MDM stacks already speak — chosen precisely because it carries post-quantum keys without modification.

Multi-tenant from day one

Every certificate, profile, and API path is tenant-scoped. Run one CA for many teams, subsidiaries, or customers — or keep the seeded default tenant and never think about it.

HSM & key protection

A pluggable crypto-provider layer: software keys encrypted at rest, or PKCS#11 for hardware security modules and tokens. Key material never crosses that boundary.

Workflow-driven lifecycle

Certificate requests move through a configurable state machine — auto-approve for dev fleets, webhooks and human approval where policy demands it.

Policy as profiles

Issuance profiles are validated JSON: per-field DN policies, key algorithm allow-lists, key-usage and EKU templates. What the profile forbids cannot be issued.

Console, CLI & API

A modern web console for operators, a scriptable CLI for automation, and a JSON REST API underneath both — including an opt-in server-side keygen flow that delivers ready-to-install PKCS#12.

How it works

From zero to quantum-safe issuance in an afternoon.

  1. Create your root

    Stand up an ML-DSA or SLH-DSA root — software-backed or on your HSM — with a profile that locks in your naming and usage policy.

  2. Define profiles

    Describe what each certificate type may contain. Validation is enforced at issuance, not left to convention.

  3. Enroll your fleet

    Point devices and services at EST or the REST API. Approvals flow through the workflow engine you configured.

  4. Operate with confidence

    CRL and OCSP endpoints publish revocation status; the console gives operators full visibility across every tenant.

Start your post-quantum migration where it matters most.

Your PKI outlives every other system you run. Build the next one on algorithms designed to outlast the quantum transition.

Request a demo