Trust our CA · manufactAI PKI

Choose a trust model

Depending on your security policy, there are two ways to integrate with this PKI. Both are supported, and the fingerprints below apply to either. Verify them before you trust anything.

Option 1 · Standard integration

Install the root certificate as your trust anchor. Our servers send the issuing CA in every TLS handshake, so this is all you need.

Maintenance: none. Issuing CAs are rotated on our side without any action on yours, including an emergency rollover.

Where the boundary sits: the root is a long-term, general-purpose trust anchor for manufactAI infrastructure. The domain boundary is enforced one level below it: the issuing CA in service carries critical RFC 5280 name constraints limiting it to our domains, and since it reaches you in the handshake, you can verify the boundary yourself at any time. Constraining every issuing CA we put into service is an operational commitment on our side. If your policy requires that boundary to be enforced cryptographically at your own trust anchor rather than by our commitment, use Option 2.

Option 2 · Strict integration (pinning)

Do not install the root. Trust the current issuing CA directly, in your application or OT configuration rather than in the system trust store.

What this gives you: direct cryptographic proof. The issuing CA certificate itself carries the name constraints, so your systems enforce the domain boundary technically, without relying on any statement from us.

Maintenance: required. The issuing CA has a shorter lifetime than the root, is rotated periodically, and may be replaced immediately during a security incident. You need a process that updates the pinned anchor for both scheduled rotations and emergencies. Without it, connections will fail. Tell us at pki@manufactai.com that you pin, and we will notify you ahead of any rotation.

Step by step

The steps below cover Option 1. For Option 2, use manufactai-global-tls-issuing-ca-ecc-p-256-2026.pem in place of the root and skip the system trust store entirely.

1. Download and verify

curl -fsSLO https://pki.manufactai.com/manufactai-global-root-ca-ecc-p-384.pem
openssl x509 -in manufactai-global-root-ca-ecc-p-384.pem -noout -fingerprint -sha256
# expected:
# sha256 Fingerprint=C4:52:99:56:32:B2:67:E6:46:2A:D6:8F:D9:4F:1F:E9:31:FF:BF:2C:3F:A8:25:53:82:10:2D:F3:D0:43:6D:A7

Compare the fingerprint character by character with the value on this page or with the value you received from us through a second channel (contract annex, signed e-mail). Do not proceed if it differs.

2. Install as trust anchor

Debian / Ubuntu

sudo cp manufactai-global-root-ca-ecc-p-384.pem /usr/local/share/ca-certificates/manufactai-global-root-ca-ecc-p-384.crt
sudo update-ca-certificates

RHEL / Fedora / SUSE

sudo cp manufactai-global-root-ca-ecc-p-384.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

macOS

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain manufactai-global-root-ca-ecc-p-384.pem

Windows (PowerShell, elevated)

Import-Certificate -FilePath .\manufactai-global-root-ca-ecc-p-384.der -CertStoreLocation Cert:\LocalMachine\Root

Java

keytool -importcert -trustcacerts -alias manufactai-global-root-ca-ecc-p-384 -file manufactai-global-root-ca-ecc-p-384.pem -cacerts -storepass changeit

Docker images (Debian-based)

COPY manufactai-global-root-ca-ecc-p-384.pem /usr/local/share/ca-certificates/manufactai-global-root-ca-ecc-p-384.crt
RUN update-ca-certificates

Kubernetes (trust bundle for workloads)

kubectl create configmap manufactai-root-ca --from-file=ca.crt=manufactai-global-root-ca-ecc-p-384.pem
# mount it into the pod or distribute it with trust-manager

Per application (curl, Python, Go), leaving the system store untouched — also the way to do Option 2

curl --cacert manufactai-chain.pem https://service.manufactai.com/
python -c "import requests; requests.get('https://…', verify='manufactai-chain.pem')"

3. Mutual TLS: accepting our client certificates

If your systems authenticate our services by client certificate, configure the chain bundle as the trusted client CA and, if your policy requires it, pin on the issuing CA subject CN=manufactAI Global TLS Issuing CA ECC P-256 2026. Our client certificates carry the service identity in the Subject Alternative Name (DNS or URI) and are valid for at most 90 days; renewal is automatic.

# nginx
ssl_client_certificate /etc/nginx/manufactai-chain.pem;
ssl_verify_client on;
ssl_verify_depth 2;
ssl_crl /etc/nginx/manufactai-global-tls-issuing-ca-ecc-p-256-2026.crl.pem;   # refresh daily from http://pki.manufactai.com/manufactai-global-tls-issuing-ca-ecc-p-256-2026.crl

# Traefik (TLSOption)
clientAuth:
  secretNames: [manufactai-chain]
  clientAuthType: RequireAndVerifyClientCert

Trusting the manufactAI root CA