Built by someone who has run this market from the other side.

Andreas Mallek built and operated CertCenter AG, the European TLS certificate and lifecycle management platform that DigiCert acquired in autumn 2020. Before and after that he spent more than twenty-five years on SSL/TLS, applied cryptography and PKI operations: integration code against the APIs of the major public CAs, discovery scanners that ran in production networks, and the back office of an EU certificate business through the regulatory changes that are now reaching the wider market again.

The lesson from that time is the premise of NextPKI: issuing a certificate is a solved problem. Knowing which certificates you run, getting the right one onto the right system in time, and proving that it works there is not, at least not for the many organisations between a spreadsheet and an enterprise PKI suite.

Why independent

The certificate authorities that also sell lifecycle tools have an interest in which CA you use. NextPKI does not sell or resell certificates and will not become a public CA. You keep your CA contracts; NextPKI works through the accounts you already hold. That independence is the product, not a feature of it.

Where it runs

NextPKI is operated from a data centre in Frankfurt am Main under German law. A data processing agreement is part of every customer contract. The discovery sensor, the component that runs inside customer networks, is source available under the PolyForm Internal Use licence so a security team can review it and build it themselves.