Page

Security Policy for PKI Trust Manager

security policy banner
Security | Policy

Security Policy for PKI Trust Manager

Overview

This document outlines the security policy for PKI Trust Manager by Securetron. As a tool designed to manage Public Key Infrastructure (PKI) environments, we prioritize security at every level of our software development and distribution. This policy describes how we handle security vulnerabilities, protect user data, and maintain the integrity of your PKI management operations.

Reporting Security Vulnerabilities

Our Commitment to Security

We take the security of PKI Trust Manager seriously. If you believe you've discovered a security vulnerability in our software, we encourage you to report it to us promptly and responsibly.

How to Report

Primary Contact: [email protected] Alternative Contact: [email protected]

Please include in your report:

  • A clear description of the vulnerability

  • Steps to reproduce the issue

  • The version of PKI Trust Manager you're using

  • Your assessment of the potential impact

  • Any proof-of-concept code or screenshots (if available)

What to Expect

  1. Acknowledgement: We will confirm receipt of your report within 48 hours

  2. Investigation: Our security team will investigate and validate the reported issue

  3. Updates: We'll provide regular updates on our progress

  4. Resolution: Once resolved, we'll coordinate disclosure with you

  5. Credit: We acknowledge security researchers who follow responsible disclosure

Security Features in PKI Trust Manager

Data Protection

  • No Credential Storage: PKI Trust Manager does not store credentials persistently

  • Local Processing: All certificate operations occur on your local infrastructure

  • Encrypted Communication: Uses secure protocols for all remote operations

  • Minimal Data Collection: We collect only necessary operational data

Access Control

  • Role-Based Permissions: Supports integration with your existing RBAC systems

  • Least Privilege Design: Operations require only necessary permissions

  • Audit Trail: All management actions are logged for security review

  • Session Management: Secure session handling with configurable timeouts

Certificate Lifecycle Security

  • Secure Key Handling: Implements industry-standard cryptographic practices

  • Template Validation: Security-focused certificate template management

  • Compliance Checking: Built-in controls for regulatory compliance

  • Revocation Management: Secure CRL and OCSP management

Vulnerability Management

Our Process

  1. Assessment: We evaluate all reported vulnerabilities for severity and impact

  2. Prioritization: Critical issues receive immediate attention

  3. Fix Development: Security patches are developed and thoroughly tested

  4. Release: Updates are distributed through our official channels

  5. Disclosure: We publicly disclose issues after patches are available

Severity Levels

  • Critical: Remote code execution, privilege escalation, or severe data exposure

  • High: Significant security bypass or data disclosure

  • Medium: Security issues with moderate impact

  • Low: Minor security observations or informational issues

Security Updates

Update Policy

  • Regular Updates: We release security updates as needed

  • Notification: Customers receive notification of available security updates

  • Patch Releases: Security fixes are backported to supported versions

  • End-of-Life: We provide advance notice for version discontinuation

Supported Versions

We provide security updates for:

  • The current major version

  • The previous major version

  • Security patches for critical issues in older versions (case-by-case basis)

Best Practices for Users

Secure Deployment

  1. Network Security: Deploy in secured network segments

  2. Access Controls: Implement proper firewall and access rules

  3. Regular Updates: Keep PKI Trust Manager updated to the latest version

  4. Monitoring: Monitor audit logs for unusual activity

Configuration Security

  1. Service Accounts: Use dedicated, least-privilege service accounts

  2. Secure Storage: Protect configuration files and audit results

  3. Backup Strategy: Maintain regular backups of management data

  4. Compliance Alignment: Configure to meet your organizational policies

Operational Security

  1. Principle of Least Privilege: Grant only necessary permissions

  2. Regular Audits: Review management activities and access patterns

  3. Incident Response: Have procedures for security incidents

  4. Training: Ensure operators understand security responsibilities

Compliance & Standards

PKI Trust Manager supports compliance with:

  • ISO 27001 Certification

  • NIST Guidelines for PKI security

  • SOC2 Alignment

  • Industry Standards for certificate management

  • Regulatory Requirements specific to your sector

Our Security Practices

Development Security

  • Secure Coding: Our developers follow industry security standards

  • Code Review: All code undergoes security review

  • Testing: Regular security testing throughout development

  • Dependency Management: We monitor third-party components for vulnerabilities

Infrastructure Security

  • Secure Build Environment: Protected development and build systems

  • Code Signing: All releases are digitally signed

  • Verification: Checksums provided for download verification

Transparency

  • Clear Documentation: Security features and configurations are documented

  • Timely Disclosure: We communicate security issues transparently

  • User Guidance: We provide security best practice documentation

Limitations & Responsibilities

Shared Responsibility

While we work to make PKI Trust Manager secure, security is a shared responsibility:

Securetron Responsibilities:

  • Provide secure software

  • Respond to vulnerability reports

  • Release security updates

  • Maintain security documentation

User Responsibilities:

  • Deploy software in secure environments

  • Apply security updates promptly

  • Configure appropriate security controls

  • Monitor for suspicious activity

  • Follow security best practices

Scope

This policy applies to:

  • PKI Trust Manager software

  • Official documentation and guides

  • Securetron-hosted distribution channels

Contact & Support

Security Concerns

Email: [email protected] PGP Key: Available at https://www.securetron.net/security/

General Support

Email: [email protected] Documentation: https://securetron.net/documentation Community: GitHub Discussions for non-security questions

Emergency Contacts

For critical security incidents affecting production environments, please indicate "URGENT" in your subject line and we will prioritize your report.

Policy Updates

We may update this security policy as needed. The latest version will always be available at https://www.securetron.net/pki-trust-manager/security-policy

Last Updated: October 2025 Policy Version: 2.0

PKI Trust Manager is developed with security as a fundamental principle. We appreciate your partnership in keeping PKI environments secure.

For all security-related concerns, please contact [email protected]