Build a Certificate Authority

Build a working CA: parse X.509 / ASN.1 DER, accept CSRs, validate domain ownership, issue certificates with proper extensions, publish to Certificate Transparency logs, manage revocation via CRL/OCSP, and protect signing keys in HSMs. The infrastructure underlying every HTTPS connection.