PKI · Identity · Automation
Every outage, breach and failed audit starts the same way: a certificate nobody owned. RootCoreX finds every key and certificate you have, renews them before they expire, and keeps the evidence auditors ask for.
Deploys in your cloud or ours. No agents required.
Chain of trust 9F2C4A
The platform
Continuous discovery across networks, clouds and clusters. Every certificate gets an owner, a policy and an automated renewal path.
Models trained on certificate telemetry that flag the outage three weeks out — the weak key, the drifted config, the renewal that will silently fail.
One policy engine for people, workloads and devices. Machine identities stop being second-class citizens.
Private keys that never leave hardware. FIPS 140-3 modules, quorum approval, and an append-only record of every operation.
Free tools we built for ourselves and kept open: chain validators, CT log watchers, and a CLI that does not require remembering OpenSSL flags.
PKI is badly taught and widely misunderstood. Academy is the course we wished existed — practical, vendor-neutral, and free.
Why RootCoreX
Certificate management is not a dashboard problem. It is an ownership problem, an automation problem, and an evidence problem. We built for all three.
Network scans, cloud APIs, Kubernetes secrets and CT logs, correlated into one inventory. The certificates you did not know about are the ones that take you down.
Renewal, deployment and reload, orchestrated per workload — with staged rollout and automatic revert when a health check fails.
Inventory by algorithm and key size, model the blast radius of a migration, and move estates to new primitives without a two-year programme.
Every issuance, approval and revocation written to an append-only log, exportable against SOC 2, ISO 27001, PCI DSS and eIDAS controls.
SaaS, private cloud or fully air-gapped. Same control plane, same API, no feature asymmetry between deployment models.
Every capability ships as an API first. Terraform provider and CLI are maintained by the same team, versioned with the platform.
Writing
Every organisation asking which PQC algorithm to pick is asking the second question first. Here is the one that comes before it.
A walkthrough of how a single intermediate expiry cascades through a service mesh, and the three controls that stop it.
Workload identity is not a smaller version of user identity. It has a different lifecycle, a different threat model, and a different failure mode.
Watch
Roadmap
Published because you should be able to check whether we ship what we say. Dates are targets, not contracts.
Q3 2026 · Shipped
Cloud-native scanning across AWS, Azure and GCP with CT log correlation.
Q4 2026
Algorithm inventory, blast-radius modelling and staged migration plans.
Q1 2027
AI-proposed fixes executed behind explicit human approval gates.
Q2 2027
ML-DSA and hybrid certificate profiles, with dual-chain rollout support.
Get started
We will run a read-only discovery against one environment and walk you through what we find. No commitment, no agents.
