Static Labs Trust Services · SLTS CA

Partner Key Registration

Generate a key pair for use with the SLTS CA third-party integration programme.
Both keys are created entirely inside your browser — the private key is never transmitted.

These certificates are not trusted by public clients

Keys generated here are valid only within the Static Labs ecosystem — browsers, operating systems, and standard TLS clients will not recognise them. They are intended exclusively for internal service-to-service authentication, SLTS CA-backed mutual TLS, and Kubian attestation partner integrations. Do not use them to secure public-facing HTTPS endpoints.

Your private key never leaves this page — keep it that way

Generation happens entirely in your browser using the Web Cryptography API. Only the public key is submitted to Static Labs. Store your private key immediately in a secrets manager, hardware security module, or encrypted vault — it cannot be recovered if lost, and Static Labs holds no copy.

Submitted public keys are listed in the SLTS CA third-party registry

When you register a key pair, your public key will be publicly listed at kubian.staticlabs.app/ca/slts/3rd-party so that other services in the SLTS ecosystem can verify tokens signed by your key. Do not submit a key you intend to keep entirely private.

Key Generation

Generate Key Pair

Key 1 —

Algorithm

Key label (optional)

Private Key (PKCS#8 PEM) — save this now

Public Key (SPKI PEM)

Key 2 —

Algorithm

Key label (optional)

Private Key (PKCS#8 PEM) — save this now

Public Key (SPKI PEM)

Public Key Registration

Submit Public Keys to SLTS CA Registry

Organisation name

Contact email

Loading key summaries…

✓ Public keys submitted successfully. They will appear in the SLTS CA third-party registry at kubian.staticlabs.app/ca/slts/3rd-party once reviewed.

✕ Submission failed. Check your connection and try again. If the issue persists, email support@staticlabs.app.com .

How these keys are used

After registration, Static Labs will countersign your public keys under SLTS CA Issuing G1, creating an intermediate certificate that other services in the ecosystem can verify without contacting you directly. Your service signs tokens with its private key; verifiers check the signature against the countersigned public key retrieved from the registry.

For outbound request signing, use RSA-PSS 4096-bit — this matches the X-Net-Certificate-SLTS header scheme. For mutual TLS or attestation flows, ECDSA P-256 is recommended for its compact signature size.

Full technical details: staticlabs.app/pki/slts · Public key registry: kubian.staticlabs.app/ca/slts/3rd-party