Trustpoint is built as a modular, open-source software stack for industrial certificate and identity management, designed to run reliably in OT environments. At its core, Trustpoint is a web-based PKI management platform that can operate either as a local Certificate Authority (CA) or as a Registration Authority (RA) connected to upstream PKIs.
The stack provides native support for industrial enrollment and management protocols such as CMP (RFC 9480/9483), EST (RFC 7030), and REST-based APIs, enabling interoperability with a wide range of devices, automation systems, and existing PKI infrastructures. A protocol orchestrator abstracts these interfaces, allowing devices to be onboarded and managed using different methods without changing the underlying trust model.
Trustpoint includes built-in components for certificate lifecycle management—issuance, renewal, revocation (CRL), and trust store distribution—combined with domain-based trust separation, where devices are grouped under dedicated cryptographic policies and issuing authorities. Keys can be generated locally, securely handled, and optionally protected using HSM or PKCS#11 interfaces.
The platform is containerized (Docker-first), enabling flexible deployment in factories, edge environments, or isolated (air-gapped) networks. A web UI and REST API support user-driven onboarding, browser-based credential retrieval, and automation workflows, while Zero-Touch Onboarding mechanisms (e.g., IDevID-based onboarding) are integrated as part of the stack.
Published under the MIT license, the Trustpoint software stack is designed to be extensible, vendor-neutral, and suitable for long-term operation in industrial environments with limited connectivity, legacy devices, and strict security requirements.