Certificate-Manager Service• Manages Certificate Lifecycle• CAdES Signing/Verification• Timestamp/OCSP Handling

Key-Manager Service• Manages Key Lifecycle• Orchestrates Cryptographic Operations

Crypto-Provider-BC• Software Provider• BouncyCastle Library

Crypto-Provider-PKCS11• Hardware Provider• PKCS#11 Library

PostgreSQLCertificate-Manager DBCA CertificatesCertificatesCertificate Template

PostgreSQLKey-Manager DBProviders ConfigClusters ConfigKeyrings ConfigKey Metadata

PostgreSQLCrypto-BC DBEncrypted KeysKey Storage

Hardware Security Module==============• Key Storage• Crypto Operations

Redis CachePKCS#11/BC CacheWrapped Session Keys

2. Application/Service Layer

4. Hardware Security Module (HSM) and Cache Layer

Hardware Security Module (HSM)• Key Storage• Crypto Operations

cyshield