SANCTUM SECOPS · PKI / PQC CONSOLE

PKI Repository

Secure the Sanctum. Guard the Future.

LAB / TEST DEMONSTRATION MATERIAL. The certificate hierarchy published in this repository (sanctum-root-ca-g1, sanctum-issuing-ca-g1, sanctum-pqc-ca-g1) is a demonstration hierarchy built to prove the repository's AIA/CRL distribution plumbing. Do not install any of these certificates in a trust store. All policy documents on this page are marked DRAFT — v0.1 pending review.

Certificates & chain (AIA)

DER-encoded CA and sample leaf certificates, served at the Authority Information Access path.

PEM copies

Human-readable PEM encodings of the same chain, for tooling convenience.

Revocation (CRL)

Base and delta CRLs, retrieved over plain HTTP per RFC 5280 — never HTTPS.

OID registry

Machine-readable registry (JSON) plus a browsable, generated HTML table.

Certificate Policy & CPS

RFC 3647 framework documents. DRAFT v0.1. HTML and PDF from a single Markdown source.

Policy documents

Subscriber and relying party agreements, and the repository privacy policy. DRAFT v0.1.

Demonstration hierarchy

sanctum-root-ca-g1 LAB/TEST — DO NOT TRUST
  ├── sanctum-issuing-ca-g1 (classical RSA/ECDSA)
  │    └── demo.pki.sanctumsecops.com (sample leaf)
  └── sanctum-pqc-ca-g1 (PQC-flagged, ML-DSA-65 target profile)