Certificate Authority

Root & intermediate certificates

TrustBridge uses a two-tier CA: an offline root that signs one intermediate, which is the only key that ever issues end-entity certificates. Verify the fingerprint below against an independent channel (e.g. ask Jeff directly) before trusting this root on a device — that verification step is the entire point of publishing a fingerprint at all.

Root CA

Subject: O=TrustBridge, CN=TrustBridge Root CA

SHA-256 fingerprint:

2A:2B:F3:63:AD:18:2E:F4:E6:73:EC:33:E5:0B:2E:6E:87:65:1D:0F:17:54:3B:03:81:FE:E3:DE:62:04:B7:83

On iOS/iPadOS, opening this link in Safari triggers "Install Profile" directly. After installing, go to Settings → General → About → Certificate Trust Settings and turn on full trust for it — a manually-installed root is never trusted automatically.

Intermediate CA

Subject: O=TrustBridge, CN=TrustBridge Intermediate CA

SHA-256 fingerprint:

2E:37:90:38:5D:06:14:D4:96:82:67:AB:2B:E4:83:53:4D:A0:C7:19:8E:70:C9:A7:42:45:FD:83:CB:55:93:8A

Combined CA bundle

Intermediate + root in one file, in chain order — trust or upload this single file instead of downloading and combining root.crt and intermediate.crt by hand.

Certificate Revocation List

Regenerated on every revocation, cached at most 24h. A live OCSP responder is also available for real-time checks — see /policies §7.