FEATURE / DESCRIPTION
Overview MTG CARA
Our experts will advise you in detail on all questions regarding the use and implementation of MTG CARA, our public key infrastructure, in your company.
- Management of large volumes of certificates by domain concept
- Offline/online Root CA
- Subordinate CAs
- Unrestricted number of Root and Sub CAs
- Certificate formats: X.509, Card Verifiable Certificates (CVC), Attribute Certificates (AC), Post-Quantum-Cryptography Certificates etc.
- Certificate templates for CA, mail, TLS, IoT, network devices, mobile
- REST API for registration authorities, certificate lifecycle management, corporate frontends
- Hardware Security Module support using PKCS#11 or HSM vendor specific interfaces (Utimaco, Thales, Entrust)
- LAN HSMs, Smart Cards, USB HSM
- Easy and smooth replacement of cryptographic algorithms
- PQC support already integrated
- MTG CARA can use Hardware Security Modules which are Common Criteria EAL4+ certified (e.g. Utimaco)
- MTG CARA can be operated according to BSI TR-03145 Secure Certification Operation
- All processes at MTG including development are certified according to ISO 27001
- OpenID Connect and SAML support
- Strong authentication using X.509 Certificates
- Usable for API and operator authentication
- MTG CARA is specifically designed to operate in clustered, high available environments
- All its components (database, web servers, HSMs) can scale up and down independently according to operational needs. MTG CARA is designed to work well in a clustered, high availability setup
- Separation of roles and rights (e.g., according to BSI TR-03145)
- Special rights and roles concept for mapping your organizational structure
- Certificates and CRLs can be exported to LDAP server or Active Directory
- Smart card support of web applications
- Easy integration into web browser
- Support of different smart cards (e.g., ID Key, NetKey, SignatureCard, CardOS, Starcos)
Use cases:
- Personalization of smart cards
- Certificate creation
- User authentication
- PDF signatures
- PIN/PUK management
- OCSP responder according RFC 6960
- OCSP stapling according to RFC 6961
- LDAP and HTTP CRL distribution point support
- Reliable and high performance
- Logging & auditing
