Automate certificate onboarding, renewal, and lifecycle management for machines and industrial devices.
Trustpoint is an open-source PKI and machine identity platform built for operational technology (OT). It helps machine builders, operators, and integrators manage X.509 identities across long-lived, segmented, and heterogeneous industrial environments.
Get Started · Documentation · Latest Release · Website
Caution
Trustpoint is currently a technology preview (beta) and is not intended for production use.
Industrial systems increasingly depend on digital identities, but certificate management in OT is often still manual, fragmented, and difficult to automate.
Machines may remain in service for decades. Networks are segmented. Devices vary widely in capability. Existing IT-centric identity workflows do not always translate cleanly to the factory floor.
Trustpoint provides a unified, open platform for machine identity and certificate lifecycle management in OT.
| The challenge | With Trustpoint |
|---|---|
| Manual certificate provisioning | Automated onboarding, enrollment, renewal, and re-enrollment |
| Fragmented certificate silos | Centralized identity and certificate lifecycle management |
| Different device capabilities | Multiple enrollment protocols and authentication methods |
| Vendor-specific workflows | Open standards, APIs, and an open-source foundation |
| PKI complexity | Web-based workflows and abstractions for industrial users |
| Long-lived devices | Lifecycle-oriented certificate management and renewal automation |
Trustpoint is designed to help you:
- Onboard machines securely using zero-touch, semi-automated, or operator-driven workflows.
- Automate certificate lifecycles from initial enrollment through renewal, rekeying, and revocation.
- Integrate with existing PKI by operating as a Certificate Authority (CA) or Registration Authority (RA).
- Use open protocols including EST, CMP, and OPC UA GDS Push.
- Automate industrial workflows through REST APIs, agents, webhooks, and approval steps.
- Protect cryptographic keys with PKCS#11-compatible HSM integration.
- Avoid vendor lock-in through interoperable protocols and an MIT-licensed open-source codebase.
The fastest way to explore Trustpoint is the guided setup wizard on a Linux host.
- Docker 20.10+
- Docker Compose 2.32.4+
- Git
git clone https://github.com/Trustpoint-Project/trustpoint.git
cd trustpoint
./tp_wizard.shThe wizard guides you through the Docker-based setup.
Then open:
http://localhost
The initial setup wizard generates a TLS certificate.
Note
You find the default initial credentials in the Docker logs.
Want the full setup flow? See the Quickstart Setup Guide.
Trustpoint manages digital identities and X.509 certificates across the device lifecycle:
Device / Machine
│
▼
Onboarding
│
▼
Initial Device Identity
│
▼
Application Certificates
│
├──► Renewal / Rekeying
│
├──► Revocation
│
└──► Decommissioning
| Method | Typical use | Authentication / trust | Lifecycle capabilities |
|---|---|---|---|
| AOKI (proof of concept) | Zero-touch industrial device onboarding | IDevID / DevOwnerID based trust | Initial device onboarding and identity establishment |
| EST | Standards-based certificate enrollment | Username/password, IDevID, client certificate | Onboarding, application certificates, renewal, re-enrollment |
| CMP | Flexible enrollment for industrial or constrained devices | Shared secret, IDevID, client certificate | Onboarding, enrollment, renewal, rekeying |
| OPC UA GDS Push | OPC UA certificate and trust-list distribution | Secure device registration and certificate authentication | Server certificate and trust-anchor distribution, cyclic updates |
| Manual / remote download | Operator-driven or browser-assisted issuance | Operator workflow / one-time password | PKCS#12 or PEM credential delivery |
Learn more:
- AOKI — Automated Onboarding Key Infrastructure
- EST API documentation
- CMP API documentation
- OPC UA GDS Push specification
- Certificate enrollment and issuance
- Renewal and re-enrollment
- Rekeying
- Certificate revocation
- Cyclic CRL generation
- JSON-based certificate profiles
- Certificate discovery
Trustpoint Agents automate certificate lifecycle workflows on or near industrial devices.
Agents can:
- automate enrollment and renewal,
- communicate with Trustpoint using mTLS,
- execute reusable deployment workflows,
- deploy renewed certificates to target systems, and
- integrate with operational monitoring through structured logs.
See the Trustpoint Agents documentation.
Trustpoint supports multiple operating models:
Certificate Authority mode
- Import an existing issuing CA
- Create an auto-generated CA for testing
- Provide CA certificates to devices through EST or CMP
- Support CA rollover workflows
Registration Authority mode
- Forward EST enrollment requests to an external CA
- Integrate Trustpoint workflows with an existing PKI
Trustpoint supports PKCS#11-based HSM integration for cryptographic key storage and operations.
For local development, Trustpoint can use a dedicated SoftHSM container through the setup wizard.
Trustpoint provides REST APIs for machine identity and certificate workflows, including:
- certificate enrollment,
- device and identity lifecycle operations,
- onboarding configuration,
- workflow definitions, and
- system integration.
This makes it possible to integrate Trustpoint into automation pipelines, MES/ERP systems, IAM processes, or custom industrial applications.
The workflow engine supports industrial processes that require more than a simple certificate request:
- manual approval steps,
- reusable workflow definitions,
- webhook integrations,
- email notifications, and
- agent-driven certificate deployment.
Trustpoint includes:
- web-based management UI,
- dashboards,
- audit logging,
- users, roles, and organizations,
- Prometheus metrics,
- mDNS-based local service discovery,
- Docker-based deployment, and
- multi-language support.
Trustpoint focuses on the realities of operational technology:
- long machine and device lifecycles,
- segmented or locally connected networks,
- mixed generations of equipment,
- limited device resources,
- different levels of automation,
- existing enterprise PKI infrastructure, and
- the need to introduce machine identities without coupling them to a single vendor.
The goal is to make strong machine identities practical across brownfield and greenfield industrial environments.
Security is a core part of the project.
The repository includes:
- a Security Policy,
- OpenSSF Best Practices tracking,
- automated testing and static analysis,
- HSM integration,
- audit logging, and
- documentation related to the EU Cyber Resilience Act, including a CRA Conformity Assessment, Threat Model, Risk Register, and Security Controls.
See the Trustpoint documentation for the current security architecture and CRA-related material.
| Resource | Description |
|---|---|
| Documentation | Complete Trustpoint documentation |
| Quickstart Setup | Install and start Trustpoint |
| Quickstart Operation | Explore Trustpoint and issue a first certificate |
| Trustpoint Agents | Automated certificate lifecycle management |
| AOKI | Zero-touch device onboarding |
| Docker Hub | Published Trustpoint container images |
| Releases | Release notes and project milestones |
Trustpoint v0.6.0 introduced major capabilities for machine identity automation and industrial deployment, including:
- Trustpoint Agent v1
- PKCS#11 HSM integration
- CA rollover
- users, roles, and organizations
- audit logging
- REST APIs and headless integration
- Prometheus metrics
- certificate discovery
- mDNS support
- redesigned workflow capabilities
- improved automated setup and deployment
See GitHub Releases for the complete changelog.
Contributions are welcome.
Start with:
If you are new to the project, check the current issues and discussions.
Have a question, idea, use case, or integration proposal?
- Join the Trustpoint Discord
- Contact us at [email protected]
- Visit industrial-security.io
We are especially interested in feedback from machine builders, factory operators, system integrators, PKI teams, security researchers, and developers working on industrial identity.
Trustpoint is licensed under the MIT License.
If Trustpoint is useful to your work, star the repository to help other industrial security developers discover it.