Sign leaf x509 certificates in-browser using your existing Root CA

Many engineering and security teams in enterprises and mid‑market organizations struggle to provision short‑lived leaf X.509 certificates for development, CI/CD, device onboarding and internal services without exposing Root CA private keys or creating slow ticketing bottlenecks. With roughly 2,000,000 organizations managing PKI globally, teams routinely resort to self‑signed certs or brittle scripts, which increases operational risk and compliance exposure. You could build an in‑browser signing experience that generates private keys and CSRs client‑side using WebCrypto and WASM, then obtains signed leaf certificates from the existing Root CA via a controlled signing gateway (short‑lived tokens, HSM‑backed proxies, or remote attestation) so the root key never leaves the CA. The product would pair developer‑first UX with enterprise controls: audit trails, RBAC, CLI/CI plugins and an offline signing mode for air‑gapped environments. This is an attractive moment: browser cryptography has matured, Zero Trust is driving internal PKI adoption, and developers expect instant local tools; the global PKI and certificate management market is approximately $4.5B (2,000,000 orgs × $2,250 ACV), with a market score of 88/100 and revenue potential of 82/100. Modern WebCrypto APIs and WASM mean feasibility and performance are no longer primary barriers to a secure client‑side approach. You can differentiate by delivering a seamless developer experience combined with HSM connectors, provable non‑export of root keys, and strong auditability, but be frank about challenges: building and certifying secure signing proxies, integrating with diverse enterprise CAs and HSMs, and overcoming medium competition and long procurement cycles.