Security model
A WAF that holds no private keys
The WAF enforces traffic policy and nothing else: no private keys, opaque certificate references, and no secrets on the event bus. Key custody and certificate lifecycle live behind their own boundaries.
The boundary
Enforcement and key custody are separate by design
A WAF is a traffic enforcement layer, not a key store. Keeping your most sensitive material out of the component in the request path means a smaller blast radius and a simpler design.
No private keys in the WAF
Opaque certificate references
Secrets never on the bus
Boundaries in context
Where each responsibility lives
Traffic is enforced at ArxLayer Edge before it reaches your origin, while key custody, certificate lifecycle, analytics, and billing stay independent. The boundary guarantee is visible in the architecture itself.
Architecture diagram. Traffic flows from the Internet to ArxLayer Edge, through Coraza with the OWASP Core Rule Set, then to your origin application. ArxLayer Trust, Certificates, Analytics, Billing, and IAM/NHI are separate platform components. No private keys traverse the event bus or config bus.
Boundary guarantee: ArxLayer Edge performs pure traffic enforcement. Certificate lifecycle, key custody, analytics, and billing are separate components — and no private keys ever traverse the event bus or config bus.
Certificate references
The WAF references certificates — it never owns them
Certificate lifecycle belongs to ArxLayer Certificates; key custody and trust bundles belong to ArxLayer Trust. The enforcement layer only ever holds an opaque reference.
Verbatim, opaque storage
Trust-controlled bundles
Lifecycle stays separate
Config bus discipline
The event bus carries references, not secrets
ArxLayer distributes configuration as events. By design, that stream contains certificate references and policy metadata only — never private keys — so the transport itself can never become a path to your secrets.
References and metadata only
No secret on the wire
Auditable by construction
Separation of duties
Each component owns exactly one responsibility
ArxLayer separates enforcement, certificate lifecycle, key custody, analytics, and billing into distinct boundaries — shrinking blast radius and keeping the WAF focused.
ArxLayer Edge
ArxLayer Certificates
ArxLayer Trust
ArxLayer Analytics
ArxLayer Billing
ArxLayer IAM / NHI
Why it matters
Bounded blast radius, simpler audit
When the component in the request path holds no secrets, a compromise there cannot leak private keys — and every boundary is easier to review on its own.
Smaller attack surface
Contained failures
Clearer ownership
Audit-friendly
Go deeper
Read the reasoning, then the architecture
Why a WAF should not own private keys
ArxLayer architecture
The ArxLayer platform
See the boundary in practice
No private keys in the request path, opaque certificate references, and separation of duties by design — see how it is wired, or talk it through with us.