Advanced Features
Post-Quantum Cryptography (QuantumProtect): ZetaCA supports ML-DSA (FIPS 204) via Utimaco QuantumProtect PKCS#11 R3 VDM. Mechanism IDs: CKM_MECH_MLDSA_GENKEY=0xC0A50001, CKM_MECH_MLDSA_SIGN=0xC0A53001, CKM_MECH_MLDSA_VERIFY=0xC0A54001. Three security levels: ML-DSA-44, ML-DSA-65, ML-DSA-87.
Hybrid/Composite Certificates: ZetaCA issues composite certificates with both classical (ECDSA P-384) and PQC (ML-DSA-65) signatures per draft IETF composite specification. Both keys stored on the same HSM.
Key Rotation: KEK rotation supported via admin CLI. DEKs automatically re-wrapped with new KEK version.
High Availability / Redundancy
ZetaCA supports multi-node HA: Patroni PostgreSQL cluster (3-node), PgBouncer connection pooling, automatic failover (<60s), multiple stateless backend workers. All workers share the same PKCS#11 config. Set SlotMultiSession=true in cs_pkcs11_R3.cfg. Utimaco HSM clustering supported via [HSMCluster] with failover or load-balancing modes.
Scalability Recommendations
For production: use dedicated HSM network (<5ms latency), ConnectionTimeout=5000, CommandTimeout=60000, KeepAlive=true. For high-throughput (ACME/EST), consider HSM clustering with load balancing.