7. Keystore

The CertKit Keystore is an on-premise service that manages private key generation and storage within your infrastructure. When active, CertKit’s cloud services only handle public material (CSRs and issued certificates). Private keys never leave the keystore host. This applies to Private PKI certificates too — keys for private-CA certificates are generated on the keystore host and signed from a CSR.

Source code is available at github.com/certkit-io/certkit-keystore.

Purpose

The Keystore is designed for environments with strict compliance or security requirements mandate that private keys remain isolated on local infrastructure.

Trade-offs

Using a local Keystore introduces several management requirements:

• Backups: You are responsible for backing up the keystore. Lost keys cannot be recovered by CertKit.
• Restricted Access: Manual downloads of PFX and Private Key files are disabled via the dashboard to ensure keys remain on-premise.
• Enterprise-Only: The Keystore is only available with Enterprise CertKit plans.

Network Requirements

Agents retrieve certificate material from the keystore over HTTPS. The keystore listens on port 443 by default. You can set a different port during installation.

If a firewall sits between an agent and the keystore host, allow inbound TCP traffic to the keystore on port 443 (or the port you configured). Every agent that retrieves certificate material needs this access, including agents on networks outside your data center. Connections use TLS 1.3 with a server certificate the keystore manages automatically.

The keystore host also needs outbound HTTPS access to CertKit to send CSRs, receive issued certificates, and validate agent requests.

Keystore UI

The Keystore page provides a per-certificate status table. Monitor this for error states, which indicate failed key generation attempts.