Issuer capability matrix
What this build can do with each certificate authority, per operation.
Served state: Served through the external-CA API and the same production server assembly tested below.
Read this before believing a "CA-agnostic" claim, including ours. Every row names the test that backs it, and the Protocol issuance proof column is separate from Issue on purpose: implementing an authority's API and having run an issuance against it are different statements, and only one of them is evidence.
This build has high-fidelity protocol issuance proof for 13 of 13 advertised authorities. Each proof starts a separate, nonce-bound authority-protocol substrate, drives the production server assembly through the provider-specific wire exchange, and independently verifies the returned certificate chain. That proves trstctl's adapter and custody path. It is not live vendor-account certification and does not prove a customer's policy, entitlement, network, appliance, or service version. Before production, run the same scoped issuance with your configured account.
| Issuer | Issue | Protocol issuance proof | Renew | Revoke | Unattended DV | Key handling |
|---|---|---|---|---|---|---|
adcs |
yes | yes | yes | no | no | requester_csr |
awspca |
yes | yes | yes | no | no | requester_csr |
azurekv |
yes | yes | yes | no | no | authority_generated |
digicert |
yes | yes | yes | no | no | requester_csr |
ejbca |
yes | yes | yes | yes | no | requester_csr |
entrust |
yes | yes | yes | no | no | requester_csr |
gcpcas |
yes | yes | yes | no | no | requester_csr |
globalsign |
yes | yes | yes | no | no | requester_csr |
letsencrypt |
yes | yes | yes | yes | yes | requester_csr |
sectigo |
yes | yes | yes | no | no | requester_csr |
smallstep |
yes | yes | yes | no | no | requester_csr |
vaultpki |
yes | yes | yes | yes | no | requester_csr |
venafi |
yes | yes | yes | no | no | requester_csr |
adcs
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: AD CS revocation runs through the CA's own management interface, which trstctl does not drive. Revoke with certutil or the Certification Authority console.
Unattended domain validation: AD CS issues from template policy against a domain identity; there is no DCV challenge to solve.
awspca
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: AWS Private CA exposes RevokeCertificate; trstctl ships no implementation. Revoke with the AWS API or console.
Unattended domain validation: AWS Private CA is internal and performs no domain validation.
azurekv
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: Azure Key Vault certificates are disabled rather than revoked, and trstctl does not drive that. Use the Azure portal or CLI.
Unattended domain validation: Azure Key Vault issues from its own policy with no domain-validation challenge trstctl drives.
digicert
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: DigiCert's API documents certificate revocation, but trstctl ships no implementation and none is tested against it. Revoke from the DigiCert console.
Unattended domain validation: Public DV/OV issuance through DigiCert's API requires validation steps trstctl does not drive. Complete DCV in the DigiCert console; trstctl cannot keep this authority validated unattended.
ejbca
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Unattended domain validation: EJBCA issues under its own certificate profile with no domain-validation challenge.
entrust
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: No revocation implementation ships. Revoke from the Entrust console.
Unattended domain validation: Entrust validation is an organizational step outside trstctl.
gcpcas
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: Google CAS exposes RevokeCertificate; trstctl ships no implementation. Revoke with the gcloud API or console.
Unattended domain validation: Google CAS is internal and performs no domain validation.
globalsign
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: No revocation implementation ships. Revoke from the GlobalSign console.
Unattended domain validation: GlobalSign validation is an organizational step outside trstctl.
letsencrypt
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
sectigo
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: Sectigo's API documents revocation; trstctl ships no implementation. Revoke from the Sectigo console.
Unattended domain validation: Sectigo SCM validation is completed in Sectigo's own console; trstctl drives no DCV method for it.
smallstep
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: step-ca exposes a revoke endpoint; trstctl ships no implementation. Revoke with the step CLI.
Unattended domain validation: step-ca issues under provisioner policy; trstctl drives no ACME challenge against it.
vaultpki
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Unattended domain validation: Vault PKI issues under its own role policy with no domain-validation challenge, so there is nothing to automate.
venafi
Backed by: internal/server: TestDODExternalCAUniversalProductionAssembly; internal/ca: TestRevokeMatrixMatchesTheImplementations, TestUnattendedDVMatrixMatchesTheImplementations, TestExternalCAHTTPDefaultsBlockSSRF
Protocol issuance proof: the universal DoD test drives this driver through its high-fidelity authority-protocol substrate and independently verifies the returned chain. This does not replace a scoped test against your real vendor account.
Revocation: Venafi's API documents revocation; trstctl ships no implementation. Revoke from Venafi.
Unattended domain validation: Venafi issues against a policy folder the account is already scoped to; trstctl performs no domain validation.