Bind did:hive to the TLS certificate you already have.

Hive runs an ACME-style middle certificate authority. It issues short-lived X.509 certificates that link a did:hive:* identity to your service's existing TLS identity, using the Subject Alternative Name URI extension. Every browser, every load balancer, and every audit tool already knows how to read it. You don't need a new transport or a new client. The trust works with the tools you already have.

Enroll in 4 lines See where this fits

Enrollment: RFC 8555 with one extension

If you already run certbot, this will feel familiar.

# Sign up a service for a cert tied to its did:hive. Standard ACME steps.
certbot certonly \
  --server https://ca.thehiveryiq.com/acme/directory \
  --domain api.your-service.com \
  --hive-did did:hive:your-service-001 \
  --hive-pubkey ed25519:<your_published_key>

# The cert you get back includes a SAN URI: did:hive:your-service-001
# Good for 30 days. It renews itself through the standard ACME process.
# Chain: your cert -> Hive Intermediate CA -> public trust anchor

Endpoints

Three URLs. That's the whole thing.

GET ca.thehiveryiq.com/acme/directory ACME directory document, per RFC 8555 section 7.1.1

POST ca.thehiveryiq.com/acme/new-order Order with an optional did-binding extension

GET ca.thehiveryiq.com/intermediate.crt Hive intermediate CA, the public chain anchor

Spec

One page. Works with existing standards. Nothing fancy.

BASE STANDARD ACME RFC 8555. We match it exactly for directory, account, order, authorization, challenge, finalize, and certificate endpoints.
CHALLENGE TYPES http-01, dns-01, tls-alpn-01. All standard, nothing custom.
EXTENSION hive-did-binding-01. This proves you control a did:hive by signing the ACME order nonce with that DID's published Ed25519 key.
CERT FORMAT X.509 v3, Ed25519 leaf, with the SAN URI extension carrying the did:hive:* identifier.
VALIDITY 30 days. It renews itself through ACME. No human has to do anything.
CHAIN ANCHOR Rooted under a publicly anchored intermediate. Long term, we're working toward inclusion in the Mozilla, Apple, and Microsoft trust stores.
RECEIPT LINK Every certificate we issue is itself a Hive receipt, submitted to ct.thehiveryiq.com. The CA is its own first customer.
REVOCATION Standard CRL and OCSP, plus a log-based check for agents that read the transparency log.
PRIVATE KEY HANDLING The issuer's private keys sit in an HSM with quorum control. A post-quantum co-signature with ML-DSA-65 (the government's post-quantum signature standard) is available behind a feature flag.

Why this matters for HARM

The CA connects to everything you've already deployed.

An agent reading the Hive transparency log sees signed receipts. But a browser visiting api.your-service.com just sees a TLS handshake. The Hive CA makes both of those match up. The certificate your browser checks is the same identity the agent is reasoning about.

Cloudflare, Datadog, every SIEM, and every enterprise procurement team already understand certificates like this. We're not asking them to adopt a new transport. We hand them a cert chain their existing tools accept on day one, and that cert chain happens to carry a did:hive right where every modern toolchain already looks.

What a certificate looks like once it's issued

Standard X.509, plus one SAN URI.

Certificate:
    Data:
        Version: 3 (0x2)
        Issuer: CN=Hive Civilization Intermediate CA G1
        Validity:
            Not Before: 2026-05-29 00:00:00 UTC
            Not After : 2026-06-28 00:00:00 UTC
        Subject: CN=api.your-service.com
        Subject Public Key Info:
            Public Key Algorithm: Ed25519
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:api.your-service.com,
                URI:did:hive:your-service-001      ← the binding
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            CT Precertificate SCTs:
                Log: ct.thehiveryiq.com/v1           ← own log inclusion
                Log: ct.googleapis.com/logs/argon2026  ← public CT log mirror

Sign up once. All your existing tools light up.

Bind your did:hive to the certificate your browser already trusts. The trust travels with you. The receipts are visible everywhere.

/harm: the full mesh /ct: the log /signal: the idea behind it