kb.sanctumsecops.com — ungated, indexable

Knowledge base

8 categories, 40 articles, no account required to read any of them

Written for the engineer who has to operate the thing, not the buyer deciding whether to. Every article title states the diagnosis rather than the symptom, and the corpus is exported as plain text so a retrieval system can read it without going through the portal.

Open the knowledge base Service desk

Host kb.sanctumsecops.com — self-service articles plus a llms-full.txt export for retrieval.

Index

The public categories

Each category states who it is written for and what it undertakes to cover. Article titles are the contract: if the title says it answers something, the article answers it.

PKI foundations

How a Sanctum hierarchy is put together and what each element is for. Written for someone who has to operate a CA, not someone deciding whether to.

5 articles

Written for Platform engineers inheriting a hierarchy somebody else designed

PKI foundations — articles
Article	What it answers
Root, issuing and cross-signed: which certificate does what in a Sanctum hierarchy	Names each tier, what it signs, and why the root is offline between ceremonies.
Reading a certificate policy and a certification practice statement	How the policy OID in a certificate maps to the practices document that governs it.
The Sanctum OID arc: what hangs off 1.3.6.1.4.1.65953	How policy, profile and extension identifiers are allocated under the Private Enterprise Number.
Path building and path validation failures, and how to tell them apart	Distinguishes a chain the client cannot construct from a chain it constructs and rejects.
Key custody: what stays in a validated module and what may leave it	The custody boundary for root, issuing and subject keys, and what an export attempt means.

Post-quantum cryptography

The FIPS 203, 204 and 205 algorithms as they appear in certificates, and what the CNSA 2.0 baseline actually requires.

5 articles

Written for Engineers asked for a PQC position by an auditor or a customer

Post-quantum cryptography — articles
Article	What it answers
FIPS 203, 204 and 205: which one is a KEM, which are signatures, and where each appears	ML-KEM for key agreement, ML-DSA and SLH-DSA for signatures, and the profile each belongs in.
Choosing an ML-DSA parameter set for a certificate profile	What the parameter choice costs in signature size and what it buys in claimed security category.
CNSA 2.0 alignment: what the baseline requires and by when	The federal baseline stated as requirements against dates rather than as a summary.
Why SLH-DSA is in the composite even though it is large	The hash-based signature as a structural backstop against a lattice break, not as a preference.
Signature and key sizes: what breaks first when a certificate gets larger	The concrete failures — record size limits, embedded device buffers, handshake fragmentation.

Composite certificates

What a composite certificate is, how it is parsed, and how a mixed estate behaves while only some of it understands one.

4 articles

Written for Teams running a migration where classical and post-quantum must coexist

Composite certificates — articles
Article	What it answers
ALBIREO: the composition under OID 1.3.6.1.4.1.65953.8.1	ML-KEM-768 plus ML-KEM-512 plus ECDSA P-384, and what each component is doing.
CYGNET-L5-Triple and when a Level 5 composition is the requirement	ML-KEM-1024 plus ML-DSA-87 plus SLH-DSA-SHA2-256s, and the cases that justify the size.
How a client that does not understand a composite behaves	What the classical lineage preserves, and where a naive client fails rather than degrades.
Composite at issuance versus a migration project	Why issuing composite from the start removes the cutover rather than scheduling it.

Certificate lifecycle

Issuance, renewal, reissue, rotation and revocation as scheduled operations, each with its verb, its authorisation and the record it writes.

6 articles

Written for Whoever gets paged when a certificate expires

Certificate lifecycle — articles
Article	What it answers
Renewal, reissue and rekey: three different operations that are not interchangeable	Which one keeps the key, which one keeps the subject, and which one requires re-validation.
Building a renewal schedule that fails safe	Renewal windows sized against validity, and what to alert on when a renewal does not happen.
Revocation: CRL and status responder, and which one your clients actually check	Distribution point placement, responder availability, and the freshness window that matters.
Emergency revocation at scale after a suspected key compromise	The order of operations when every affected subject has to be revoked and re-issued.
Short-lived certificates as an alternative to revocation checking	When validity shorter than the revocation propagation window is the simpler control.
Reading a lifecycle record: who authorised this, and what changed	How to reconstruct an issuance a year later from the evidence record rather than from memory.

Enrolment and device onboarding

Getting a first certificate onto a device that has no identity yet, and every certificate after it without a human in the path.

5 articles

Written for Fleet and device teams issuing to hardware

Enrolment and device onboarding — articles
Article	What it answers
First-boot enrolment: bootstrapping identity on a device that has none	How the initial trust is established and what the bootstrap credential may and may not authorise.
Hardware-rooted enrolment: binding the certificate to the module that holds the key	Attestation at enrolment, so the certificate proves where the key lives and not just that it exists.
Re-enrolment and rotation without a maintenance window	Overlapping validity so a device is never between identities.
Enrolment failures: the six that account for most tickets	Clock skew, wrong profile, malformed subject, unmet attestation, expired bootstrap, and tenant mismatch.
Decommissioning: revoking a device identity you no longer physically hold	What to revoke, in what order, and what the evidence record must contain.

Validation and CSR requirements

What a certificate signing request must contain, and how domain and organisation control is demonstrated to each authority.

5 articles

Written for Anyone whose order stopped moving

Validation and CSR requirements — articles
Article	What it answers
CSR requirements: subject, key type, and the fields that are ignored	What the CA reads out of a CSR and what it overwrites from the profile.
Domain control validation by email, HTTP file and DNS record	The three methods, what each proves, and which one survives a CDN in front of the origin.
Organisation and extended validation: what is verified and against what source	The vetting steps behind an OV or EV subject, and why they take days rather than minutes.
Multi-domain and wildcard: how the SAN set is validated	Per-name validation, wildcard scope, and what a SAN change requires.
Why an order is stuck: reading the approver list and the validation state	Diagnosing a pending order from the approver list rather than by re-ordering.

API and integration

The API shape, the vocabulary, and how an integration behaves when the far side is unavailable.

5 articles

Written for Engineers coding against the issuance interface

API and integration — articles
Article	What it answers
One verb per operation: why removal and disclosure are never a bare DELETE	How the vocabulary makes the console label, the route and the log line the same word.
Authenticating to the issuance API and scoping a key to a tenant	Key scope, tenant binding, and what an over-scoped credential can reach.
Idempotency and retries on an issuance call	How to retry safely without issuing twice, and what the record shows when you do.
Errors that mean stop, and errors that mean retry	Distinguishing a rejected profile from a transient failure, without guessing.
Reading the evidence record for a call you made	Locating the append that corresponds to a request, and what it does and does not contain.

Troubleshooting

The failures that generate tickets, with the diagnosis rather than the symptom as the article title.

5 articles

Written for Whoever is currently looking at a failed handshake

Troubleshooting — articles
Article	What it answers
Handshake fails after a composite cutover: fragmentation and record size	Why a larger certificate breaks a terminator that was fine the day before.
Trust store says untrusted but the chain is complete	Missing intermediate versus missing anchor versus a policy constraint that rejects the path.
Clock skew: the failure that looks like every other failure	How to eliminate time as a cause in one check before investigating anything else.
Renewal succeeded but the service still presents the old certificate	Reload semantics, cached chains, and where the stale copy is actually held.
Revocation checked as unknown rather than good or revoked	Responder reachability, distribution point mismatch, and what clients do with unknown.

Retrieval

Built to be read by machines as well as people

The knowledge base exists partly so that a support agent, an internal assistant or a customer's own tooling can answer a question without a ticket.

The plain-text export

The whole public corpus is published as a single plain-text file at the knowledge base host, so a retrieval pipeline ingests one document rather than walking a portal. It carries only the eight public categories; the withheld two never appear in it.

The export is regenerated from the same articles the portal serves, which is the only way to keep the two from drifting apart.

Why the titles look like that

An article called Troubleshooting TLS answers nothing. An article called Handshake fails after a composite cutover: fragmentation and record size tells you in the title whether it is your problem.

Titles state the diagnosis. It makes the index longer and makes searching it shorter, which is the correct trade for documentation somebody reads under pressure.

Withheld

Categories that exist but are not published

Named rather than hidden. Customers under a monitoring or incident retainer receive the parts that apply to their own estate.

Non-public categories
Category	Why it is not public
Security incident response runbooks	Agent-only inside the service desk. The runbooks name detection thresholds and containment steps that are more useful to an attacker than to a reader.
Managed detection and SOC procedures	Agent-only inside the service desk, for the same reason. Customers under a monitoring retainer receive the parts that apply to their own estate.

Knowledge base kb.sanctumsecops.comRetrieval export llms-full.txtPublic articles 40

If an article should exist and does not, say so

Recurring questions get converted into articles rather than answered twice. Raise it through the service desk at S4 and it goes into the queue with the rest.

Browse articles Raise a request