Hierarchy
Two-tier hierarchy. The root is kept offline and is only used to certify issuing CAs. All end-entity certificates chain to the issuing CA; relying parties only need to trust the root.
CA certificates
manufactAI Global Root CA ECC P-384 OFFLINE
Trust anchor. Kept offline; used only to sign issuing CA certificates and the root CRL.
| Subject | CN=manufactAI Global Root CA ECC P-384 |
|---|---|
| Issuer | CN=manufactAI Global Root CA ECC P-384 |
| Serial number | F6ABF7316557B2D725342A31833DCC98 |
| Valid until | 2046-08-19 |
| Public key | ECDSA P-384 (384 bit) |
| Signature | ECDSA with SHA384 |
| Subject key identifier | BD:03:52:14:A4:A4:49:F2:B0:17:5F:C6:04:0E:46:9D:F7:D9:51:A7 |
| SHA-256 fingerprint | C4:52:99:56:32:B2:67:E6:46:2A:D6:8F:D9:4F:1F:E9:31:FF:BF:2C:3F:A8:25:53:82:10:2D:F3:D0:43:6D:A7 |
manufactAI Global TLS Issuing CA ECC P-256 2026 ONLINE
Online issuing authority. Signs all end-entity certificates (TLS server, mTLS client, internal services).
| Subject | CN=manufactAI Global TLS Issuing CA ECC P-256 2026 |
|---|---|
| Issuer | CN=manufactAI Global Root CA ECC P-384 |
| Serial number | 27EE522141E9BCE4A34C2D46A5829329 |
| Valid until | 2031-08-23 |
| Public key | ECDSA P-256 (256 bit) |
| Signature | ECDSA with SHA384 |
| Subject key identifier | 48:A4:09:18:28:7C:6C:21:8C:2F:F0:34:EF:40:F1:33:0A:F2:B4:BF |
| SHA-256 fingerprint | DA:7C:F0:2F:CF:6B:E9:E5:E6:EE:B2:DC:F5:67:83:6F:8A:3C:C3:35:4E:C6:B0:71:9D:96:51:C9:3C:7E:B4:0D |
Certificate chain bundle
Issuing CA followed by root CA, PEM encoded. Use this as the CA bundle for TLS clients and reverse proxies that validate our certificates.
| SHA-256 (bundle file) | 89:6A:CC:72:DB:C8:BA:94:BA:59:DB:07:E1:C7:E3:BB:84:D3:B0:93:AC:71:53:B8:F9:7D:A2:A2:BB:5A:18:96 |
|---|
Certificate revocation list
Issuing CA CRL current
Regenerated by the issuing CA on every revocation and republished here within 15 minutes. The distribution point embedded in our certificates is http://pki.manufactai.com/manufactai-global-tls-issuing-ca-ecc-p-256-2026.crl, served over plain HTTP so that strict validators can fetch it without depending on the public web PKI.
| Issuer | CN=manufactAI Global TLS Issuing CA ECC P-256 2026 |
|---|---|
| This update | 2026-10-20 06:29 UTC |
| Next update | 2026-10-24 06:29 UTC |
| Revoked certificates | 0 |
| SHA-256 (DER) | 4B:40:68:20:71:9E:EC:B5:F6:D1:61:AB:55:1B:0C:86:56:75:39:16:30:26:48:71:73:2B:92:83:AA:6B:78:93 |
Root CRL current
Signed offline by the root CA. It states whether an issuing CA has been revoked and is referenced by the CRL distribution point inside the issuing CA certificate: http://pki.manufactai.com/manufactai-global-root-ca-ecc-p-384.crl.
| Issuer | CN=manufactAI Global Root CA ECC P-384 |
|---|---|
| This update | 2026-08-24 12:22 UTC |
| Next update | 2026-10-30 12:22 UTC |
| Revoked CA certificates | 0 |
| SHA-256 (DER) | 87:35:D1:CA:F7:BF:3E:98:7F:51:4E:BE:C2:52:BB:76:3D:6C:0F:EE:50:B9:C4:BD:B1:76:C5:E3:FE:C3:B8:3C |