Trust our CA · manufactAI PKI

Step by step

Install only the root certificate. Never install the issuing CA as a trust anchor – it is rotated more frequently and is delivered in the TLS handshake by our servers. Always verify the fingerprint before trusting.

1. Download and verify

curl -fsSLO https://pki.manufactai.com/manufactai-root-ca-g1.pem
openssl x509 -in manufactai-root-ca-g1.pem -noout -fingerprint -sha256
# expected:
# sha256 Fingerprint=EB:E2:11:B9:0D:66:0F:57:CC:35:1F:1F:9D:8D:B0:C3:EE:CD:23:C9:CB:62:4C:FE:02:FC:FC:F9:EA:3C:0A:86

Compare the fingerprint character by character with the value on this page or with the value you received from us through a second channel (contract annex, signed e-mail). Do not proceed if it differs.

2. Install as trust anchor

Debian / Ubuntu

sudo cp manufactai-root-ca-g1.pem /usr/local/share/ca-certificates/manufactai-root-ca-g1.crt
sudo update-ca-certificates

RHEL / Fedora / SUSE

sudo cp manufactai-root-ca-g1.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

macOS

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain manufactai-root-ca-g1.pem

Windows (PowerShell, elevated)

Import-Certificate -FilePath .\manufactai-root-ca-g1.der -CertStoreLocation Cert:\LocalMachine\Root

Java

keytool -importcert -trustcacerts -alias manufactai-root-ca-g1 -file manufactai-root-ca-g1.pem -cacerts -storepass changeit

Docker images (Debian-based)

COPY manufactai-root-ca-g1.pem /usr/local/share/ca-certificates/manufactai-root-ca-g1.crt
RUN update-ca-certificates

Kubernetes (trust bundle for workloads)

kubectl create configmap manufactai-root-ca --from-file=ca.crt=manufactai-root-ca-g1.pem
# mount it into the pod or distribute it with trust-manager

Application-level (curl, Python, Go) – without touching the system store

curl --cacert manufactai-chain.pem https://service.example.com/
python -c "import requests; requests.get('https://…', verify='manufactai-chain.pem')"

3. Mutual TLS: accepting our client certificates

If your systems authenticate our services by client certificate, configure the chain bundle as the trusted client CA and, if your policy requires it, pin on the issuing CA subject CN=manufactAI Issuing CA 1. Our client certificates carry the service identity in the Subject Alternative Name (DNS or URI) and are valid for at most 90 days; renewal is automatic.

# nginx
ssl_client_certificate /etc/nginx/manufactai-chain.pem;
ssl_verify_client on;
ssl_verify_depth 2;
ssl_crl /etc/nginx/manufactai-issuing-ca-1.crl.pem;   # refresh daily from http://pki.manufactai.com/manufactai-issuing-ca-1.crl

# Traefik (TLSOption)
clientAuth:
  secretNames: [manufactai-chain]
  clientAuthType: RequireAndVerifyClientCert

Trusting the manufactAI root CA