In high-security environments, private keys are generated inside a Hardware Security Module, a network appliance, or an air-gapped server — and they never leave. TigerTrust’s CSR-only signing flow accommodates this: you bring the public half of the key pair as a CSR, TigerTrust signs it against your internal CA, and you download the certificate. The private key is never transmitted or stored by the platform.
Csr Only Signing

​
What it is

You generate a CSR on your device, paste the PEM into TigerTrust (or submit it via the API), select a CA and certificate template, and receive a signed certificate plus the full chain. The resulting certificate is tracked in your inventory with full expiry monitoring and alert coverage, but the private key download option is permanently absent — TigerTrust cannot offer something it does not hold.

​
When to use it

  • Issue certificates for HSM-backed service identities where the HSM generates the key pair and exports only the CSR.
  • Sign certificates for network appliances (firewalls, load balancers) that generate their own keys internally.
  • Support an air-gapped PKI workflow where key generation happens offline and only the CSR travels across the network.
  • Integrate with an existing PKCS#11 infrastructure without moving private key material into TigerTrust.

​
Set it up

1

Generate the CSR on your device

Use your HSM, appliance, or local PKI tooling to generate a key pair and produce a PEM-encoded CSR. Copy the CSR PEM value.
2

Open the CSR signing wizard

Go to Certificates > Issue and select Submit CSR at the top of the wizard instead of the standard guided issuance flow.
3

Paste the CSR

Paste the PEM into the CSR field. TigerTrust validates the CSR’s self-signature immediately and shows the parsed Common Name and SANs it extracted. If the CSR is malformed the wizard shows an error before you proceed.
4

Select CA and template

Choose the CA that should sign the certificate and the certificate template that defines the key usage and validity period. The CA must belong to your workspace.
5

Sign and download

Click Sign. The signed certificate and chain are available for download immediately. The certificate also appears in your Certificates inventory for ongoing monitoring.

​
What you’ll see

The resulting certificate row in Certificates shows the Common Name, SANs (including any IP SANs extracted from the CSR), expiry, and issuer. The detail panel does not show a private key download button — that option is permanently suppressed for CSR-signed certificates. Expiry alerts and renewal notifications work as normal; when renewal is due you repeat the CSR submission flow with a fresh CSR from the device.
IP address SANs present in the CSR are extracted and included in the signed certificate automatically. See IP Address SAN Certificates for CA constraints on IP SANs.

​
Tips

  • Certificate validity is capped at 825 days regardless of what you request. Most private CAs enforce a lower limit based on their profile configuration.

IP Address SAN Certificates

IP SANs extracted from CSRs are supported.

PKI Core

The internal CA that processes CSR sign requests.

Certificate Issuance

Standard issuance flow when the platform holds the key.