Independent root CA
Kitsos Root CA 1
SHA-256 · 5E:15:BD:5B:8F:06:77:73:3B:F4:A2:31:6D:C1:88:EA:3F:69:FF:9D:B2:89:A0:45:86:12:3E:39:7E:1A:C7:95
Public PKI
Kitsos Trust
The public certificate infrastructure from Kitsos: two independent root CAs, ten intermediate CAs and the sharded Kitsos Onyx Certificate Transparency log.
Kitsos Root CA 1ECDSA P-384 · self-signed
Kitsos Root CA 2RSA 4096 · self-signed
Kitsos Root CA 1Cross-sign certificate for Root CA 2
5 intermediate CAsTLS · S/MIME · Signing · Client
5 RSA intermediate CAsTLS · S/MIME · Signing · Client
Certificate hierarchy
Root CAs and their intermediate CAs
Root CA 1 and Root CA 2 are independent, self-signed trust anchors. An additional certificate cross-signs Root CA 2 through Root CA 1. Each root signs its own intermediate CAs.
Additional trust relationshipKitsos Root CA 1Root CA 2 cross-sign certificate
Signed directly by Root CA 1Intermediate CAs Show certificatesHide certificates
Kitsos TLS CA G1
Issues TLS/HTTPS server certificates.
SHA-256 · AC:19:BC:F0:10:48:DA:77:0D:1C:BF:8D:E8:14:2C:88:38:53:0C:7D:F5:D6:DC:26:2C:60:E2:65:DB:A7:45:EB
Kitsos S/MIME CA G2
Issues S/MIME certificates for signed and encrypted email.
SHA-256 · BC:33:78:84:58:62:D9:D2:05:E0:C6:99:E0:74:D3:47:42:3D:E0:2D:3E:7C:30:8E:B0:BA:64:04:75:5A:71:6F
Kitsos Document Signing CA G1
Issues certificates for digital document signatures.
SHA-256 · EC:9B:21:83:51:3F:CF:30:49:B2:B1:E3:2C:BF:D8:D9:2F:BE:56:FE:C4:8D:E4:27:01:6A:16:02:C5:9A:70:4C
Kitsos Code Signing CA G1
Issues certificates for signing software, scripts and updates.
SHA-256 · 9F:50:34:AD:21:03:03:93:0C:66:9E:95:57:3E:0D:D8:72:9A:1F:9E:42:AC:A2:15:31:FB:19:2F:D4:3C:F3:EE
Kitsos Client CA G1
Issues client certificates for mutual TLS authentication.
SHA-256 · 5C:CB:08:1B:8F:D5:CD:7F:89:32:D3:7D:11:31:28:36:2F:EE:DF:CA:F3:9A:A2:4E:E3:C9:52:62:4F:A2:C9:89
Independent root CA
Kitsos Root CA 2
SHA-256 · 19:DE:34:F1:07:8D:50:03:8A:67:11:03:BF:01:71:B3:16:54:DB:B7:F3:06:48:3C:7E:46:60:EC:BB:1C:BB:34
Signed by Root CA 2RSA intermediate CAs Show certificatesHide certificates
Kitsos TLS RSA CA G1
Issues TLS/HTTPS server certificates.
SHA-256 · 71:ED:A6:20:A2:1E:9B:90:50:7C:97:2C:4E:16:4D:C9:17:19:57:67:C8:C8:CA:42:33:0D:FB:74:4C:AF:BB:99
Kitsos S/MIME RSA CA G1
Issues S/MIME certificates for signed and encrypted email.
SHA-256 · AF:7B:8F:5A:47:23:2F:20:C9:43:F0:35:ED:B5:D5:33:A9:B9:FE:0E:C5:C0:22:8D:E9:61:78:45:85:D0:E3:44
Kitsos Document Signing RSA CA G1
Issues certificates for digital document signatures.
SHA-256 · BD:22:89:3F:B4:5D:11:9F:0B:03:BC:E4:CE:4E:0E:BE:46:54:F0:7F:4F:8E:E7:1F:9A:97:F6:F2:A9:76:CB:22
Kitsos Code Signing RSA CA G1
Issues certificates for signing software, scripts and updates.
SHA-256 · E9:0A:BC:BC:B9:77:2A:6B:36:87:4E:5D:7C:29:86:F9:0B:95:61:D4:5D:4C:68:61:9B:16:5F:B3:F5:10:B1:5E
Kitsos Client RSA CA G1
Issues client certificates for mutual TLS authentication.
SHA-256 · A0:DF:58:E8:D1:1F:EB:39:70:E5:F4:76:50:CA:70:26:F9:4D:F1:F8:A2:3B:05:D7:A1:31:40:04:5C:56:18:C8
Certificate issuance
Request certificates
The public request flows are being prepared and will be released step by step.
Planned
TLS certificates via ACME
TLS certificates will be requested through ACME. The public ACME endpoint is currently in development.
Planned
Other certificate types
Request flows for S/MIME, client, code-signing and document-signing certificates are planned.
Installation and request guides will later be published in the Kitsos Docs.
Certificate Transparency
Kitsos Onyx
Kitsos Onyx records certificates issued under the Kitsos roots in separate time-based shards. The explorer provides public search and inspection.