Jellyfish

Bring openssl-ca under Jellyfish management 

Jellyfish openssl-ca Migration enables organisations to bring an openssl-ca instance under Jellyfish management while keeping current PKI services operational. A host-side tool scans openssl-ca and synchronises certificate authorities, templates, issued certificates, keys, and revocations into Jellyfish over the REST API. 

openssl-ca is OpenSSL's sample minimal CA application. It is a non-production, proof-of-concept and workbench-style solution. OpenSSL is not enterprise CA software. 

Jellyfish is Cogito Group's enterprise PKI platform. It provides certificate authority, certificate lifecycle management, and key management, including HSM-backed operations, high availability, enrolment services, and Cog VA validation. 

Keep openssl-ca running while you modernise 

  • openssl-ca continues to issue 
  • Jellyfish CA is introduced as the enterprise CA 
  • Jellyfish keeps both environments aligned 
  • Your team migrates at a controlled pace 

Jellyfish acts as the central management and synchronisation layer across the transition. Operators gain a unified view of certificate and revocation state while openssl-ca continues to serve existing workloads. Automation end points can move over days, weeks, or months rather than in a single change. 

A migration model built for enterprise reality 

Enterprise PKI is not isolated. Certificate Authorities are connected to identity platforms, applications, network services, and smartcards. Jellyfish openssl-ca Migration brings a workbench CA under enterprise management without replacing every integration at once. 

Business Benefits 

Lower migration risk 

openssl-ca is not switched off before Jellyfish is introduced. Existing issuing, validation, and integration services continue while Jellyfish synchronises the environment. 

Move historical keys under HSM protection 

openssl-ca commonly stores signing keys as files. Migrating those keys into an HSM improves protection of historical CA material. Generating CA keys inside the HSM with native Jellyfish CA is the better approach for a long-lived production PKI. 

Centralised PKI visibility 

Jellyfish is a single pane of glass for PKI operations: certificate visibility, CA management, lifecycle data, and operational reporting. 

Operational Outcomes 

With Jellyfish openssl-ca Migration, organisations can: 

  • Maintain continuity of openssl-ca services 
  • Synchronise issued certificates and revocations into Jellyfish and Cog VA 
  • Import available keys and reconstructed templates 
  • Use Jellyfish certificate lifecycle management immediately, before issuance is cut over 
  • Retire openssl-ca when the organisation is ready 

Simplified migration strategy 

Follow these steps in order. openssl-ca remains in service until you choose to cut over. 

  1. Deploy beside openssl-ca 

Install the migration tool on a host with filesystem access to openssl-ca. The tool uploads to Jellyfish over the REST API. Jellyfish does not need inbound access to the CA files. 

  1. Scan and synchronise 

The tool parses openssl.cnf and the CA directory, then performs a bulk load of CAs, templates, certificates, keys, and revocations, followed by incremental scheduled updates. 

  1. Provision CA signing capability 

Provide Jellyfish CA with access to existing openssl-ca key material using HSM, PKCS#11, or secure soft-key migration. 

  1. Transition validation services 

Update CRL and OCSP paths so validation services point to Cog VA. Cog VA reflects revocations from openssl-ca and from Jellyfish CA. 

  1. Migrate integrations progressively 

Move enrolment services and applications across as required. 

A workbench CA and an industry-standard PKI 

openssl-ca is a sample, workbench-style CA. It is suitable for proof-of-concept and lab use. It is not enterprise CA software. 

Jellyfish is Cogito Group's industry-standard, enterprise-grade PKI platform. It provides full certificate authority, certificate lifecycle, and key management, with HSM-backed operations, high availability, enrolment services, and Cog VA validation.