CA Manager: mTLS Certificate API for B2B Partner Authentication

The challenge with running mTLS in production

Mutual TLS is the right answer when you need to authenticate B2B partners, internal microservices, proprietary clients, or devices without relying on shared secrets. But the path to running mTLS in production involves significant operational complexity: standing up and maintaining a certificate authority, implementing revocation infrastructure (CRL publication, OCSP responders), managing key rotation, ensuring high availability, and writing the API surface that your applications will use to request and rotate certificates. For most teams, this is months of platform engineering work plus ongoing maintenance.

What CA Manager does

CA Manager is an API-first certificate authority service. A single authenticated REST call issues an x.509v3 certificate signed by your private CA. Industry-standard cryptography is supported, with configurable key algorithms, signing parameters, and validity periods. Certificate bundles are returned through either an inline API response or a presigned download URL, so CI/CD pipelines, mobile build systems, and runtime workloads can fetch them programmatically without operating any PKI infrastructure of their own.

Predictable pricing built for steady production workloads

Pricing is contract-based, starting at $199/month for up to 100 certificates and scaling to $1,999/month for up to 5,000 certificates. Overage certificates are billed per unit at rates that decrease at higher tiers. There is no separate fee for CRL or OCSP. Both are included in every plan.

Managed revocation, included in every plan

Revocation is fully managed. CA Manager exposes public CRL and OCSP endpoints so relying parties can validate certificate status in real time without you running responders, scheduling CRL publication, or maintaining revocation infrastructure. Both CRL and OCSP are included in every contract tier.

Multi-tenant by design, AWS-native operations

Each customer operates inside an isolated trust boundary, with its own dedicated CA, certificate inventory, and revocation list. There is no shared CA across tenants. Operational activity is logged through AWS CloudTrail, so customers using AWS-native observability stacks can ingest CA Manager events alongside the rest of their AWS audit data.

Where CA Manager fits best

CA Manager is designed for scenarios where you control both sides of the mTLS handshake and a private CA is the appropriate trust model. It is not for use cases that require certificates anchored to publicly trusted root programs. Common production workloads include: authenticating B2B partner integrations, internal microservice-to-microservice mTLS, proprietary SDK or client authentication, device and terminal authentication, CI/CD and supply chain agent authentication, and zero trust service mesh deployments.

Who this is for

You are a fintech, SaaS platform, payments company, or engineering team that:

• Issues mTLS certificates today through manual or semi-manual processes
• Authenticates B2B partners, internal services, or proprietary clients with mutual TLS
• Needs API-driven certificate issuance without standing up and operating PKI infrastructure
• Wants predictable contract pricing with transparent overage rates
• Controls both endpoints of the mTLS handshake (no public root program requirement)