Support CBOM Format for Certificate Upload and Algorithm Metadata Integration

Solution Value Statement

Enable IBM Concert to ingest certificate data using the CBOM (Cryptographic Bill of Materials) format, including algorithm metadata, to improve automation, interoperability, and cryptographic posture visibility across enterprise environments.

Proposed Solution

Extend Concert’s ingestion pipeline to support CBOM-formatted certificate uploads via API and UI. This includes parsing algorithm metadata (e.g., RSA, ECC, SHA-256), validating cryptographic properties, and integrating CBOM data into the certificate inventory and policy compliance engine. Concert should also support CBOM schema validation and provide sample templates for integration with external tools.

Customer Impact / Business Value

• Simplifies automation and integration with external certificate management tools.

• Enhances cryptographic visibility and policy enforcement.

• Reduces manual formatting and transformation of certificate data.

• Supports enterprise security teams in tracking algorithm usage and compliance.

• Aligns with emerging standards for cryptographic transparency and supply chain security.

Pilot or Validation Context

Initial validation can be scoped to clients using CBOM for certificate lifecycle management. Concert should ingest CBOM files via API, validate algorithm metadata, and surface compliance status in the Operations dimension. Pilot should include integration with GitHub-hosted CBOM examples and validation against Concert’s certificate policy engine.

Key Functional Requirements

• Support CBOM JSON format for certificate ingestion.

• Parse and validate algorithm metadata (e.g., key type, hash algorithm, key length).

• Integrate CBOM data into certificate inventory and policy compliance engine.

• Extend API to accept CBOM uploads with metadata.

• Provide sample CBOM templates and schema documentation.

• Visualize algorithm compliance status in certificate views.

• Trigger automation rules for non-compliant algorithms (e.g., SHA-1, RSA <2048-bit).

Metrics for Success

• Number of CBOM files successfully ingested.

• % of certificates with algorithm metadata parsed and validated.

• Reduction in manual certificate formatting effort.

• Number of automation rules triggered based on algorithm compliance.

• Adoption rate of CBOM format among enterprise clients.

Roadmap & Feature Overlap Analysis

• Existing Epic(s):

  • Certificate Upload and Management

  • ConcertDef SBOM Support

  • Certificate Policy Compliance and Automation

• Overlap Summary:
  Concert currently supports certificate uploads in CSV and JSON formats (ConcertDef schema). It includes policy enforcement for hash algorithms and key lengths, and automation for expiring certificates. However, CBOM is not explicitly supported, and algorithm metadata ingestion is limited to policy checks—not structured ingestion. [9286062_0_...oncert.pdf | PowerPoint]

• Unmet Needs:

  • No support for CBOM schema or algorithm metadata ingestion.

  • No CBOM validation or schema documentation.

  • No integration with CBOM tooling or GitHub examples.

  • No structured visualization of cryptographic posture per certificate.