Live mTLS revocation — in under 60 seconds
The headline of every SkyQon prospect call. A real EJBCA cluster issues a real certificate. A real mTLS-protected service grants access. The certificate is revoked — OCSP propagates — the same client is denied. Live. No simulations, no mocks. The whole flow takes under a minute.
Five steps. One minute. Real revocation.
Each step below executes against a production-grade lab on Proxmox. The exact commands are shown so your engineers can reproduce them.
Issue the test certificate
The dashboard's "Issue Certificate" action posts a CSR to EJBCA REST. Profile MTLS_CLIENT, ECDSA P-384, signed by SkyQon Issuing CA G2. Cert and key returned within seconds.
POST /ejbca-rest-api/v1/certificate/pkcs10enroll
Verify mTLS access
Use the freshly issued cert to reach an mTLS-protected service. HAProxy verifies the chain at the edge (verify required, ca-file IssuingCA-G2.crt) and proxies the request to Nextcloud / Graylog / RKE2.
curl --cert test.pem --key test.key https://nc.skyqon.com → 200 OK
Revoke the certificate
Click "Revoke" in the PKI Ops Dashboard, or call EJBCA REST directly. Reason: KEY_COMPROMISE. EJBCA writes the revocation to its audit log and updates the OCSP responder's view immediately.
PUT /ejbca-rest-api/v1/certificate/{issuer}/{serial}/revoke
OCSP propagation
The OCSP responder reflects the revocation immediately. CRL publication follows within the configured window (typically 60 minutes) — but OCSP is the authoritative real-time signal HAProxy queries.
openssl ocsp -issuer IssuingCA-G2.crt -cert test.pem … → revoked
Service denies access
Re-run the same curl. HAProxy rejects the connection because the cert is now revoked according to OCSP. The application never sees the request — the access is gone.
curl --cert test.pem … → 403 / connection refused
Production-grade. Not a sandbox.
Every component runs on Proxmox VE the same way it would in a customer deployment. We doubled the lab as our demo asset deliberately — so when we say "lab-proven," we mean it literally.
EJBCA cluster
Two backends behind the pki.skyqon.com VIP. ECDSA P-384 / SHA3-512. SoftHSM2-backed keys.
MariaDB Galera
A three-node Galera cluster. HAProxy single-writer VIP with PROXY protocol v2 to preserve client IP.
HashiCorp Vault
Application secrets via KV-v2. AppRole authentication for non-human credential delivery.
HAProxy
TLS termination with mTLS at the edge. verify required on the Nextcloud / Graylog frontend.
Salt + Woodpecker
Salt master fronted by nginx for TLS. Woodpecker CI dispatches state apply through salt-api.
Graylog
A single observability sink. EJBCA audit, salt events and mTLS handshake failures — one timeline.
Three ways to see it
Live walkthrough
Book a 30-minute call with a SkyQon engineer. We run it on our infrastructure while you watch and ask questions.
Book a callFrom the dashboard
The PKI Ops Dashboard drives the demo end to end, walking through every step with the exact commands.
See the platform ↗On your own infrastructure
We help you deploy the same setup — a PKI design plus automation engagement. End result: you can run this on a Tuesday.
Read more →Want to watch it live?
Book a 30-minute walkthrough. We share the screen, run the demo end to end, and answer the technical questions your CA team will ask.