Services

A post-quantum PKI stood up in your own account, its root bound to the custody you choose, issuing to your first fleet — with the transcripts of your build and the discipline that keeps it running.

The problem an engagement solves

Standing up post-quantum PKI is not difficult because of the cryptography. It is difficult because of the dozen components around the cryptography that fail silently: the database that cannot name the group, the operating system policy that withholds the algorithms on both ends of the wire, the runtime that has them and will not use them, the automation that would replace the host. Teams find these alone, in production, after the budget is spent. GreenPhysics found them first, numbered them, and fixed each one in a form you can run.

What you get

• Your own authority, in your own account. Declared in Terraform, pinned by digest, built in front of you; nothing of ours is left behind that you cannot read.
• The ceremony. Your root in the custody you choose — AWS KMS, Fortanix DSM, a Luna, or a module you already own — bound to the issuing authority by a witnessed ceremony whose transcript you keep.
• The first fleet. Issuance to your first servers, the TLS posture decided per listener and measured at the wire, and the edge configured for what your load balancers can and cannot carry.
• The discipline. The operating rules that came from the book's own mistakes — read the plan, dump the database, check the policy on both ends — written into your runbooks, not ours.
• The evidence. A verification suite that proves the chain, the handshake and the profile, which you can hand to an auditor and run again after every change.

Scope and price

Every step of this work has been measured, so scoping is a measurement rather than an estimate. A first conversation establishes your estate, your custody requirement and your profile (interoperable, or CNSA 2.0), and returns a fixed scope. Where a managed service is the better answer for you — and for an estate that lives entirely in one provider's account with no custody requirement of its own, it sometimes is — the engagement will say so.