mTLS certificate API for B2B partner authentication.

Issue, renew, and revoke mTLS certificates via REST API. CRL and OCSP responder hosted on a dedicated CDN. Audit log included. Built for Brazilian fintechs that authenticate dozens to hundreds of B2B partners in private integrations, without operating PKI internally.

The use case

B2B partner authentication, in production.

Brazilian fintechs that integrate with partner ecosystems, payment processors, sub-acquirers, BaaS clients, financial service consumers, face the same operational problem: dozens to hundreds of certificate-authenticated mTLS connections to manage.

Where CA Manager fits in your stack

What's in the box

Full certificate lifecycle, managed.

From zero to production

Six steps, six API calls.

A complete certificate lifecycle, demonstrated. Authenticate with a JWT bearer token delivered after subscribing on AWS Marketplace. Administrative API at https://ca.swepay.com.br; PKI infrastructure (CRL, OCSP) at https://ca-cdn.swepay.com.br.

1. 0. Initialize your CA (one-time)

   Before issuing certificates, initialize your tenant's private Certificate Authority. The root key is generated and stored in managed cryptographic custody within Swepay's infrastructure, not accessible externally, not extractable.

   Requestbash

   curl -X POST https://ca.swepay.com.br/v1/ca/initialize \
     -H "Authorization: Bearer ${SWEPAY_JWT}" \
     -H "Content-Type: application/json" \
     -d '{
       "commonName": "Your Fintech Root CA",
       "organization": "Your Fintech S.A.",
       "country": "BR",
       "validityYears": 10
     }'

   Responsejson

   {
     "caId": "8f3c9b2e-1a4d-4e5f-9c8a-2b3d4e5f6a7b",
     "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAk...",
     "expiresAt": "2036-05-22T14:30:00Z"
   }

2. 1. Issue a client certificate

   Provide identity attributes. CA Manager generates the key pair and returns the certificate in four delivery formats, choose what fits your runtime.

   Requestbash

   curl -X POST https://ca.swepay.com.br/v1/certificates \
     -H "Authorization: Bearer ${SWEPAY_JWT}" \
     -H "Content-Type: application/json" \
     -d '{
       "clientId": "partner_001",
       "commonName": "partner.example.com",
       "organization": "Partner Inc",
       "organizationalUnit": "B2B Integrations",
       "country": "BR",
       "validityDays": 365,
       "responseFormat": "Text",
       "passwordProtected": true
     }'

   Responsejson

   {
     "certificateId": "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
     "serialNumber": "01:23:45:67:89:AB:CD:EF",
     "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXT...",
     "privateKeyPem": "-----BEGIN PRIVATE KEY-----\nMIIE...",
     "expiresAt": "2027-05-22T14:30:00Z",
     "pfxBase64": "MIIK1QIBAzCC...",
     "password": "p@ssw0rd-Gen3rated"
   }

3. 2. Query certificate status

   Get full certificate details by ID, status, validity, expiration countdown.

   Requestbash

   curl https://ca.swepay.com.br/v1/certificates/a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d \
     -H "Authorization: Bearer ${SWEPAY_JWT}"

   Responsejson

   {
     "certificateId": "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
     "status": "Active",
     "issuedAt": "2026-05-22T14:30:00Z",
     "expiresAt": "2027-05-22T14:30:00Z",
     "daysUntilExpiration": 365
   }

4. 3. Revoke a certificate

   Revoke with RFC 5280 reason code. Certificate is added to the CRL within minutes.

   Requestbash

   curl -X POST https://ca.swepay.com.br/v1/certificates/a1b2c3d4-.../revoke \
     -H "Authorization: Bearer ${SWEPAY_JWT}" \
     -H "Content-Type: application/json" \
     -d '{
       "reason": "Private key suspected compromised on partner side",
       "reasonCode": "KeyCompromise"
     }'

   Responsejson

   {
     "certificateId": "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
     "revokedAt": "2026-05-23T10:15:00Z"
   }

5. 4. Monitor expiring certificates

   Query certificates expiring within a window. Useful for proactive renewal automation.

   Requestbash

   curl "https://ca.swepay.com.br/v1/certificates/expiring?days=30" \
     -H "Authorization: Bearer ${SWEPAY_JWT}"

   Responsejson

   {
     "days": 30,
     "certificates": [
       {
         "certificateId": "...",
         "commonName": "partner.example.com",
         "expiresAt": "2026-06-15T14:30:00Z",
         "daysUntilExpiry": 24
       }
     ]
   }

6. 5. Partner-side: validate via OCSP

   Your partner's mTLS client queries the OCSP responder on the CDN during handshake. RFC 6960 standard.

   Requestbash

   openssl ocsp \
     -issuer ca.pem \
     -cert partner-cert.pem \
     -url https://ca-cdn.swepay.com.br/v1/tenants/${TENANT_ID}/ocsp \
     -resp_text

   Responsejson

   Response verify OK
   partner-cert.pem: revoked
     This Update: May 23 10:15:00 2026 GMT
     Revocation Time: May 23 10:15:00 2026 GMT
     Revocation Reason: keyCompromise (0x1)

Full API reference, OpenAPI spec, and architecture details on the developers page. For technical questions, email [email protected].

Pricing

Pay for what you use. No floor, no overage surprises.

Plans differ by certificate volume included. All plans get the same API, same audit log, same OCSP responder, same support response time. Subscribe and upgrade via AWS Marketplace.

Be honest about scope

What CA Manager is not.

Brazilian financial infrastructure is full of overlapping standards. We want you to know exactly when CA Manager is not the right tool.

CA Manager is used in production by Brazilian payment processors authenticating B2B partner integrations.

Four ways to start.