Summary
Local secret storage, encryption at rest and separation of duties — general principles (segmented key: see product docs).
Definitions
This article introduces Key management and local vaults in an educational way. Keywords: vault, PKCS#12, segmentation.
- Object — what the mechanism protects or attests (integrity, authenticity, confidentiality, trust).
- Actors — issuer, subject, verifier, and any authority involved.
- Artefacts — certificates, tokens, lists, logs, reports.
How it works
- Identify the trust need (who must prove what to whom).
- Choose the right mechanism (certificate, signature, TLS, timestamping…).
- Produce or obtain the required artefacts.
- Publish / install / present the artefacts to the verifier.
- Verify (chain, validity, revocation, policy) before granting trust.
Examples
- An HTTPS server presenting a complete TLS chain up to an anchored root.
- A signed PDF document (PAdES) verified locally, then optionally through an independent validator.
- A local inventory of machine certificates to detect expirations (Windows).
Summary tables
| Question | Typical answer |
|---|---|
| What is proven? | Depending on the mechanism: server identity, document integrity, non-repudiation… |
| Who can verify? | Any verifier that has the required trust anchors / policies. |
| What expires? | Often the certificate / token — not necessarily the document itself. |
Good practices
- Document trust anchors and how they are renewed.
- Separate test and production environments.
- Log issuances, installs and revocations.
- Do not expose private keys in repositories or tickets.
Common mistakes
- Incomplete chain (missing intermediates).
- DNS name outside the SAN.
- Confusing encryption with signature.
- Presenting an undelivered product capability as available.
FAQ
Frequently asked questions are gathered on the dedicated page : Browse the FAQ.
Definitions : glossary · certificate · TLS · PKI · EviDNA.
Glossary
The site’s terminology reference is the CertiShielder™ glossary (stable anchors).
To go further
Continue with the official sources below, then the related articles. The glossary clarifies the terms ; the FAQ covers edge cases. The goal is not to close the topic, but to open the useful next step.