EC Datacenter HSM
The private keys of the Root CA and the Issuing CA(s) are the most sensitive assets in a PKI. EC therefore protects them with dedicated, enterprise-grade FIPS 140-3 Level 3 Hardware Security Modules (HSMs). An HSM is a physical, tamper-resistant hardware device; the HSMs used for PKI-as-a-Service are installed in the EC datacenter, not in a public cloud service.
- Keys are created and used inside the HSM. The CA private keys are generated inside the device and are never exported in plain text. Every certificate and CRL signature is produced by the HSM, so the keys never exist as ordinary software keys on the CA servers.
- Physical and logical protection. The HSMs sit in a secured datacenter with restricted physical access, and only authorised EC personnel can administer them, under dual control.
- No key management burden for the customer. The customer does not buy, install, patch or guard HSM hardware, and does not handle CA private keys at any point.
- Recovery. EC keeps HSM-protected key backups so that the CAs can be recovered after a failure.