Trustpoint

Trustpoint is an open-source platform for managing digital machine identities and their certificate lifecycle in industrial environments.

It is designed for machines, industrial devices, components and OT infrastructure where certificates need to be issued, deployed, renewed, revoked and managed throughout the lifetime of a device or system.

Unlike PKI tools primarily designed for traditional IT environments, Trustpoint is built around the requirements of industrial networks. It can be operated locally without a cloud connection and is suitable for segmented, restricted and fully air-gapped environments.

Trustpoint can operate as a Certificate Authority (CA) or as a Registration Authority (RA) connected to an external PKI. It provides a central interface for managing devices, certificate profiles, trust relationships and issued credentials.

Certificate enrollment and lifecycle operations can be automated using standard protocols such as EST and CMP. Trustpoint also supports industrial use cases such as OPC UA certificate management and device onboarding.

For devices that do not provide a standardized certificate enrollment interface, Trustpoint can also integrate certificate management through device-specific mechanisms. This makes it possible to include existing and brownfield equipment in a centralized certificate management process.

Trustpoint is intended for machine builders, automation vendors, component manufacturers, system integrators and operators of industrial networks that need certificate management without introducing a cloud dependency or vendor-specific PKI ecosystem.

Key features:

• Central management of digital machine identities
• Certificate issuance, renewal and revocation
• Certificate Authority (CA) functionality
• Registration Authority (RA) functionality for external PKIs
• EST certificate enrollment
• CMP certificate enrollment
• REST API
• Certificate profiles and policies
• Device and credential lifecycle management
• OPC UA certificate management
• Automated device onboarding
• Support for Zero-Touch onboarding scenarios
• Management of trust stores and trust relationships
• Support for brownfield devices
• Local and self-hosted deployment
• Operation in segmented networks
• Air-gapped operation
• Web-based administration
• Automation interfaces for integration into industrial environments
• Open-source development