VeilNet
VeilNet platform · 03 Manage

Manage the network, every identity and PQC TLS.

See the traffic every node reports, admit, renew and revoke every machine's identity, and issue and test post-quantum TLS 1.3 with the conflux toolkit, all on infrastructure you own.

Book a demoRead the docs
In the guardian console

Every node's traffic and health, live.

Each node reports its metrics and flows over OTLP: connections, peers, messages and frames over time, and every flow with its peer, protocol, port and bytes in each direction. Payloads are never reported.

Illustrative

One node's metrics: its uptime, reachability, connections, peers and neighbours as its realm's admin node last heard them, counters since it started, and history charts of its connections, peers, messages and frames that run on as it reports.

What you manage

The network, every identity and post-quantum TLS.

  • NetworkTraffic, reachability and relay loadEvery node reports its flows, connections and how it is reached, with 90 days of history. A node that stops reporting is flagged immediately.gateway-3 → ws-ops-01 · tcp 443 · 8.8 MiB sent
  • IdentityAdmit, renew and revokeCommission each machine with its own ML-DSA identity. Credentials renew automatically, 90 days by default, and a compromised machine can be blocked or revoked from the console.renewed · 90 days
  • CertificatesAn ML-DSA PKIIssue keys, certificates and revocation lists from a managed CA, with ML-DSA from the root to the leaf.conflux cert ca issue ./ca --csr server.csr --bundle
  • TLS 1.3Test post-quantum TLSProbe any server, or serve TLS 1.3 yourself, and see the key exchange and signature it negotiates. --require-pq fails anything classical.conflux cert probe server.example:8443 --require-pq
PQC TLS 1.3 toolkit

Post-quantum TLS and PKI, in one binary.

  1. ProbeConnect to any TLS server as a FIPS 140-3 client, and report the version, key exchange, signature and chain it negotiates.
  2. ServeAnswer TLS 1.3 as a FIPS 140-3 server, and report what each client offered and what was agreed.
  3. Issue and verifyML-DSA keys, requests, certificates and a managed CA with revocation lists. Verify any chain against your own roots.
  4. FIPS 140-3Every key, signature and cipher comes from the Go Cryptographic Module, and PKCS#12 uses the approved profile.
conflux cert · probing a TLS 1.3 serverIllustrative
$ conflux cert probe server.example:8443 --ca root.pem --require-pq
Connected to server.example:8443 (192.0.2.10:8443), as server.example
tls TLS 1.3, TLS_AES_128_GCM_SHA256
key exchange SecP384r1MLKEM1024 (hybrid)
signature ML-DSA-65 (pqc)
chain verified for server.example, authentication pqc
post-quantum key exchange yes; authentication yes
Talk to us

Need expert support for your migration?

Our engineers can assess your cryptography, design the transition and validate it with your team. Talk to us about consultancy.

Talk to usConsultancy