# Key Handling and Storage

### Key Handling and Storage

Secure **key handling and storage** are fundamental to the security of certificate lifecycle management and public/private trust operations. In CertiNext, cryptographic keys are treated as high-value security assets and are protected using strong controls across their entire lifecycle—from generation and storage to usage and retirement.

The platform’s design aligns with enterprise security expectations, audited trust frameworks, and modern cryptographic best practices.

***

#### Key Generation

Cryptographic keys used within CertiNext are generated using approved algorithms and key sizes aligned with industry standards.

* Keys are generated in **secure, controlled environments**
* For CA and trust-critical operations, keys are generated **inside Hardware Security Modules (HSMs)** to prevent exposure
* Key generation policies enforce approved cryptographic standards and key lengths

This ensures keys are created with strong entropy and never exposed in plaintext form.

***

#### Key Storage and Protection

Private keys are **never stored in application memory or file systems**.

Key storage follows these principles:

* Keys are stored exclusively within **secure key stores or HSMs**
* Access to keys is tightly restricted and role-controlled
* Keys are protected against extraction, tampering, or unauthorized use

In SaaS deployments, CertiNext uses **FIPS 140-2 Level 3 compliant HSMs** hosted and operated by eMudhra in secure data centers. These HSMs provide hardware-enforced key protection, secure execution, and auditability.

***

#### HSM Isolation and Partitioning

To ensure strong tenant separation and cryptographic isolation:

* **Dedicated HSM partitions** can be provisioned per customer on request
* Each partition enforces logical separation of keys and cryptographic operations
* Access to partitions is strictly controlled and audited

This model ensures that one customer’s keys cannot be accessed or impacted by another.

***

#### Key Usage Controls

Key usage is governed by strict policies that define:

* Permitted cryptographic operations (signing, encryption, decryption)
* Allowed certificate types and trust contexts
* Validity periods and rotation requirements

Keys can only be used through approved workflows and APIs. Direct key access or export is not permitted, significantly reducing the risk of compromise.

***

#### Key Rotation and Lifecycle Management

CertiNext supports controlled **key lifecycle management**, including:

* Scheduled or policy-driven key rotation
* Replacement of keys during certificate renewal or reissuance
* Decommissioning and secure retirement of obsolete or compromised keys

These processes support crypto-agility and long-term security hygiene.

***

#### Access Control and Auditability

All key-related operations are:

* Restricted using least-privilege access controls
* Logged in tamper-evident audit logs
* Traceable to specific users, roles, or system processes

This supports accountability, forensic analysis, and compliance audits.

***

#### On-Premises Deployments

In on-prem deployments:

* Key handling and storage integrate with **customer-managed HSMs or key management systems**
* Customers retain full control over key custody, backup, and recovery
* CertiNext interacts with keys only through approved cryptographic interfaces

This allows alignment with existing enterprise PKI and security architectures.

***

#### Security and Compliance Alignment

CertiNext’s key handling and storage practices align with:

* WebTrust principles for public trust operations
* Enterprise security frameworks such as ISO 27001 and SOC 2
* Industry best practices for PKI and cryptographic key management

***

#### Summary

CertiNext treats cryptographic keys as the **root of trust**. By combining secure key generation, hardware-based storage, strict usage controls, HSM isolation, lifecycle management, and full auditability, CertiNext ensures that keys remain protected, compliant, and resilient—supporting both public trust and private PKI environments with enterprise-grade security.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.certinext.io/documentation/security-architecture/key-handling-and-storage.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.