Private PKI (Private/Internal Public Key Infrastructure) is a dedicated and secure environment designed to manage digital trust within a closed group of entities. Unlike the public Web PKI, it bypasses global authorities and relies on its own internal certification authority. This concept is ideal for B2B integrations, API interfaces, and communication between contractual partners where widespread public trust is not required, but emphasis is placed on maximum control over certificate issuance, security, and precisely defined contractual terms.

Establishing and securely operating an in-house root certification authority (Root CA) demands significant technological, human, and financial investments in cybersecurity. If an organization prefers not to build and maintain its own infrastructure, leveraging our company as a commercial Trust Service Provider (TSP) offers a highly efficient alternative.
We provide a dedicated issuing authority tailored for your contractual PKI, where we guarantee and manage the entire technological operation, compliance with security standards, and physical protection of cryptographic keys (e.g., within Hardware Security Modules – HSMs).

A Private PKI TLS Certificate (hereinafter referred to as the "TLS certificate") contains a single mandatory attribute: CN (CommonName), which indicates the name of the component or device. A fully qualified domain name (FQDN) of the component (e.g., CN=www.disig.sk) or an IP address must be used as the CN. A prerequisite for issuance is demonstrating that the relevant domain or IP address belongs to the entity applying for the TLS certificate.
Optional attributes include Organization (O), Organizational Unit (OU), Locality (L), State or Province Name (ST), and Country Name (C). If the Organization (O) field is populated in the request, the Locality (L) attribute will be filled with the municipality where the legal entity specified in the O attribute is registered/resides. It is also possible to include additional FQDNs or IP addresses in the Subject Alternative Name (SAN) extension. These are not embedded directly into the certificate signing request (CSR) but are provided separately when submitting the application.

The applicant for a TLS certificate may be::

1. Legal person
2. Natural person

Applicant identification

TThe applicant for this type of certificate submits, according to the scope of the completed items, the subject in the TLS certificate application:

Legal person

• Identity Card - Statutory Representative or Plenipotentiary;
• Power of attorney - submitted in case the statutory body of the certificate holder cannot personally visit the RA branch and had authorized another person to take over the certificate. Only the power of attorney verified by a notary is accepted;
• Original or officially certified copy of the extract from the trade register not older than three months (to be consulted);
• An officially certified copy or photocopy of the extract from the trade register (remains on RA Disig).

Natural person

• Identity Card - Statutory Representative or Plenipotentiary
  1. Citizen of the Slovak Republic - valid identity card
  2. U citizen - identity card
  3. Third-country national - residence permit on the territory of the Slovak Republic and another document with a photo confirming his / her identity
• Power of attorney - submitted in case the statutory body of the certificate holder cannot personally visit the RA branch and had authorized another person to take over the certificate. Only the power of attorney verified by a notary is accepted!

Create a request to issue a TLS certificate

A TLS certificate is issued based on an electronic request in PKCS#10 or SPKAC format, which the applicant generates on their own system resources.

The process of issuing a TLS certificate

TLS certificate can only be issued at the head office of Disig, a.s. The applicant shall send the certificate request by e-mail to radisig@disig. The RA employee checks the formal correctness of the certificate request and verifies the control over all the domains in request as well as other data according to internal regulations. After completing all the necessary verifications he/she shall agree on a date for the meeting with the applicant. At a face-to-face meeting, the RA staff member verifies the compliance of the data in the application with the data in the submitted documents. After verifying the identity of the applicant for the certificate, the RA worker will forward the request to the CA for processing. The process of issuing the TLS certificate is completed by signing the appropriate documentation. At the client's request, the RA worker saves the issued TLS certificate on the device brought by the client. The issuing process takes about 20 minutes.

TLS certificate validity

A TLS certificate is valid from the moment of issue. A TLS certificate is issued with a maximum validity of 3 years.
After this period the TLS certificate expires automatically and can no longer be used for the purpose for which it was issued. A TLS certificate that has expired or has been revoked cannot be renewed. For renewal, the applicant must proceed with the entire process of requesting and verifying identity as in issuing the original TLS certificate.

Price for issuing a TLS certificate.