diff --git a/Makefile.am b/Makefile.am
index f179262..b4bca0f 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -51,6 +51,10 @@
 
 SUBDIRS = test
 
+if CA_CERT_EXTENSION
+SUBDIRS += bmc-vmi-ca
+endif
+
 check_PROGRAMS =
 XFAIL_TESTS =
 
diff --git a/bmc-vmi-ca/Makefile.am b/bmc-vmi-ca/Makefile.am
new file mode 100644
index 0000000..c33f499
--- /dev/null
+++ b/bmc-vmi-ca/Makefile.am
@@ -0,0 +1,29 @@
+bin_PROGRAMS = \
+	bmc-vmi-ca
+
+noinst_HEADERS = \
+	ca_cert_entry.hpp \
+	ca_certs_manager.hpp
+
+if HAVE_SYSTEMD
+systemdsystemunit_DATA = \
+	bmc-vmi-ca-manager.service
+endif
+
+bmc_vmi_ca_SOURCES = \
+	mainapp.cpp \
+	ca_cert_entry.cpp \
+	ca_certs_manager.cpp
+
+bmc_vmi_ca_LDFLAGS = \
+	$(SDBUSPLUS_LIBS) \
+	$(SDEVENTPLUS_LIBS) \
+	$(PHOSPHOR_DBUS_INTERFACES_LIBS) \
+	$(PHOSPHOR_LOGGING_LIBS) \
+	-lstdc++fs
+
+bmc_vmi_ca_CXXFLAGS = \
+	$(SYSTEMD_CFLAGS) \
+	$(SDEVENTPLUS_LIBS) \
+	$(PHOSPHOR_DBUS_INTERFACES_CFLAGS) \
+	$(PHOSPHOR_LOGGING_CFLAGS)
diff --git a/bmc-vmi-ca/bmc-vmi-ca-manager.service b/bmc-vmi-ca/bmc-vmi-ca-manager.service
new file mode 100644
index 0000000..52bba44
--- /dev/null
+++ b/bmc-vmi-ca/bmc-vmi-ca-manager.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=BMC VMI CA authority manager
+
+[Service]
+ExecStart=/usr/bin/env bmc-vmi-ca
+SyslogIdentifier=bmc-vmi-ca
+Restart=always
+
+Type=dbus
+BusName=xyz.openbmc_project.Certs.ca.authority.Manager
+
+[Install]
+WantedBy=multi-user.target
diff --git a/bmc-vmi-ca/ca_cert_entry.cpp b/bmc-vmi-ca/ca_cert_entry.cpp
new file mode 100644
index 0000000..94c0a25
--- /dev/null
+++ b/bmc-vmi-ca/ca_cert_entry.cpp
@@ -0,0 +1,18 @@
+#include "config.h"
+
+#include "ca_cert_entry.hpp"
+
+#include "ca_certs_manager.hpp"
+
+namespace ca
+{
+namespace cert
+{
+
+void Entry::delete_()
+{
+    // Remove entry D-bus object
+    manager.erase(id);
+}
+} // namespace cert
+} // namespace ca
diff --git a/bmc-vmi-ca/ca_cert_entry.hpp b/bmc-vmi-ca/ca_cert_entry.hpp
new file mode 100644
index 0000000..245a5cc
--- /dev/null
+++ b/bmc-vmi-ca/ca_cert_entry.hpp
@@ -0,0 +1,72 @@
+#pragma once
+
+#include "xyz/openbmc_project/Certs/Entry/server.hpp"
+#include "xyz/openbmc_project/Object/Delete/server.hpp"
+#include "xyz/openbmc_project/PLDM/Provider/Certs/Authority/CSR/server.hpp"
+
+#include <sdbusplus/bus.hpp>
+#include <sdbusplus/server/object.hpp>
+
+namespace ca
+{
+namespace cert
+{
+
+using Delete = sdbusplus::xyz::openbmc_project::Object::server::Delete;
+
+using CertEntry = sdbusplus::xyz::openbmc_project::Certs::server::Entry;
+using CSREntry = sdbusplus::xyz::openbmc_project::PLDM::Provider::Certs::
+    Authority::server::CSR;
+using Ifaces = sdbusplus::server::object::object<CSREntry, CertEntry, Delete>;
+
+class CACertMgr;
+
+/** @class Entry
+ *  @brief CA authority certificate Entry implementation.
+ *  @details A concrete implementation for the
+ *           xyz.openbmc_project.Certs.Entry DBus API
+ */
+class Entry : public Ifaces
+{
+  public:
+    Entry() = delete;
+    Entry(const Entry&) = delete;
+    Entry& operator=(const Entry&) = delete;
+    Entry(Entry&&) = delete;
+    Entry& operator=(Entry&&) = delete;
+    ~Entry() = default;
+
+    /** @brief Constructor to put object onto bus at a D-Bus path.
+     *  @param[in] bus - Bus to attach to.
+     *  @param[in] objPath - The D-Bus object path to attach at.
+     *  @param[in] entryId - Entry id
+     *  @param[in] csr     - csr string
+     *  @param[in] cert    - client certificate
+     */
+    Entry(sdbusplus::bus::bus& bus, const std::string& objPath,
+          uint32_t entryId, std::string& csr, std::string& cert,
+          CACertMgr& manager) :
+        Ifaces(bus, objPath.c_str(), true),
+        bus(bus), id(entryId), manager(manager)
+
+    {
+        cSR(csr);
+        clientCertificate(cert);
+
+        // Emit deferred signal.
+        this->emit_object_added();
+    };
+
+    void delete_() override;
+
+  protected:
+    /** @brief sdbusplus handler */
+    sdbusplus::bus::bus& bus;
+    uint32_t id;
+    /** @brief object path */
+    std::string objectPath;
+    /** @brief Reference to Certificate Manager */
+    CACertMgr& manager;
+};
+} // namespace cert
+} // namespace ca
diff --git a/bmc-vmi-ca/ca_certs_manager.cpp b/bmc-vmi-ca/ca_certs_manager.cpp
new file mode 100644
index 0000000..f6622ff
--- /dev/null
+++ b/bmc-vmi-ca/ca_certs_manager.cpp
@@ -0,0 +1,71 @@
+#include "config.h"
+
+#include "ca_certs_manager.hpp"
+
+#include <filesystem>
+#include <fstream>
+#include <phosphor-logging/elog-errors.hpp>
+#include <phosphor-logging/elog.hpp>
+#include <phosphor-logging/log.hpp>
+#include <xyz/openbmc_project/Common/error.hpp>
+
+namespace ca
+{
+namespace cert
+{
+static constexpr auto objectEntry = "/xyz/openbmc_project/certs/entry";
+static constexpr auto maxCertSize = 4096;
+namespace fs = std::filesystem;
+using namespace phosphor::logging;
+using InvalidArgument =
+    sdbusplus::xyz::openbmc_project::Common::Error::InvalidArgument;
+using Argument = xyz::openbmc_project::Common::InvalidArgument;
+
+sdbusplus::message::object_path CACertMgr::signCSR(std::string csr)
+{
+    std::string objPath;
+    try
+    {
+        if (csr.size() > maxCertSize)
+        {
+            log<level::ERR>("Invalid CSR size");
+            elog<InvalidArgument>(Argument::ARGUMENT_NAME("CSR"),
+                                  Argument::ARGUMENT_VALUE(csr.c_str()));
+        }
+        auto id = lastEntryId + 1;
+        objPath = fs::path(objectEntry) / std::to_string(id);
+        std::string cert;
+        // Creating the dbus object here with the empty certificate string
+        // actual signing is being done by the hypervisor, once it signs then
+        // the certificate string would be updated with actual certificate.
+        entries.insert(std::make_pair(
+            id, std::make_unique<Entry>(bus, objPath, id, csr, cert, *this)));
+        lastEntryId++;
+    }
+    catch (const std::invalid_argument& e)
+    {
+        log<level::ERR>(e.what());
+        elog<InvalidArgument>(Argument::ARGUMENT_NAME("csr"),
+                              Argument::ARGUMENT_VALUE(csr.c_str()));
+    }
+    return objPath;
+}
+
+void CACertMgr::erase(uint32_t entryId)
+{
+    entries.erase(entryId);
+}
+
+void CACertMgr::deleteAll()
+{
+    auto iter = entries.begin();
+    while (iter != entries.end())
+    {
+        auto& entry = iter->second;
+        ++iter;
+        entry->delete_();
+    }
+}
+
+} // namespace cert
+} // namespace ca
diff --git a/bmc-vmi-ca/ca_certs_manager.hpp b/bmc-vmi-ca/ca_certs_manager.hpp
new file mode 100644
index 0000000..9d6231e
--- /dev/null
+++ b/bmc-vmi-ca/ca_certs_manager.hpp
@@ -0,0 +1,77 @@
+#pragma once
+
+#include "ca_cert_entry.hpp"
+#include "xyz/openbmc_project/Certs/Authority/server.hpp"
+#include "xyz/openbmc_project/Collection/DeleteAll/server.hpp"
+
+#include <sdbusplus/bus.hpp>
+#include <sdbusplus/server/object.hpp>
+#include <sdeventplus/source/event.hpp>
+
+namespace ca
+{
+namespace cert
+{
+
+class CACertMgr;
+
+using CreateIface = sdbusplus::server::object::object<
+    sdbusplus::xyz::openbmc_project::Certs::server::Authority,
+    sdbusplus::xyz::openbmc_project::Collection::server::DeleteAll>;
+using Mgr = ca::cert::CACertMgr;
+
+/** @class Manager
+ *  @brief Implementation for the
+ *         xyz.openbmc_project.Certs.ca.authority.Manager DBus API.
+ */
+class CACertMgr : public CreateIface
+{
+  public:
+    CACertMgr() = delete;
+    CACertMgr(const CACertMgr&) = delete;
+    CACertMgr& operator=(const CACertMgr&) = delete;
+    CACertMgr(CACertMgr&&) = delete;
+    CACertMgr& operator=(CACertMgr&&) = delete;
+    virtual ~CACertMgr() = default;
+
+    /** @brief Constructor to put object onto bus at a dbus path.
+     *  @param[in] bus - Bus to attach to.
+     *  @param[in] path - Path to attach at.
+     */
+    CACertMgr(sdbusplus::bus::bus& bus, sdeventplus::Event& event,
+              const char* path) :
+        CreateIface(bus, path),
+        bus(bus), event(event), objectPath(path), lastEntryId(0){};
+
+    /** @brief This method provides signing authority functionality.
+               It signs the certificate and creates the CSR request entry Dbus
+     Object.
+     *  @param[in] csr - csr string
+     *  @return Object path
+     */
+    sdbusplus::message::object_path signCSR(std::string csr) override;
+
+    /** @brief Erase specified entry d-bus object
+     *  @param[in] entryId - unique identifier of the entry
+     */
+    void erase(uint32_t entryId);
+
+    /** @brief  Erase all entries
+     */
+    void deleteAll() override;
+
+  private:
+    /** @brief sdbusplus DBus bus connection. */
+    sdbusplus::bus::bus& bus;
+    // sdevent Event handle
+    sdeventplus::Event& event;
+
+    std::map<uint32_t, std::unique_ptr<Entry>> entries;
+    /** @brief object path */
+    std::string objectPath;
+    /** @brief Id of the last certificate entry */
+    uint32_t lastEntryId;
+};
+
+} // namespace cert
+} // namespace ca
diff --git a/bmc-vmi-ca/mainapp.cpp b/bmc-vmi-ca/mainapp.cpp
new file mode 100644
index 0000000..8c1aa06
--- /dev/null
+++ b/bmc-vmi-ca/mainapp.cpp
@@ -0,0 +1,28 @@
+#include "config.h"
+
+#include "ca_certs_manager.hpp"
+
+#include <sdeventplus/event.hpp>
+#include <string>
+
+int main(int argc, char** argv)
+{
+    auto bus = sdbusplus::bus::new_default();
+    std::string objPath = "/xyz/openbmc_project/certs/ca";
+
+    // Add sdbusplus ObjectManager
+    sdbusplus::server::manager::manager objManager(bus, objPath.c_str());
+
+    // Get default event loop
+    auto event = sdeventplus::Event::get_default();
+
+    // Attach the bus to sd_event to service user requests
+    bus.attach_event(event.get(), SD_EVENT_PRIORITY_NORMAL);
+
+    ca::cert::CACertMgr manager(bus, event, objPath.c_str());
+
+    std::string busName = "xyz.openbmc_project.Certs.ca.authority.Manager";
+    bus.request_name(busName.c_str());
+    event.loop();
+    return 0;
+}
diff --git a/configure.ac b/configure.ac
index afbdc8f..29a3485 100644
--- a/configure.ac
+++ b/configure.ac
@@ -19,6 +19,27 @@
 AX_CXX_COMPILE_STDCXX([17], [noext], [mandatory])
 AX_APPEND_COMPILE_FLAGS([-Wall -Werror], [CXXFLAGS])
 
+PKG_PROG_PKG_CONFIG
+AC_ARG_WITH([systemdsystemunitdir],
+     [AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files])],
+     [],
+     [with_systemdsystemunitdir=auto]
+)
+AS_IF([test "x$with_systemdsystemunitdir" = "xyes" -o "x$with_systemdsystemunitdir" = "xauto"],
+    [def_systemdsystemunitdir=$($PKG_CONFIG --variable=systemdsystemunitdir systemd)
+     AS_IF([test "x$def_systemdsystemunitdir" = "x"],
+           [AS_IF([test "x$with_systemdsystemunitdir" = "xyes"],
+                  [AC_MSG_ERROR([systemd support requested but pkg-config unable to query systemd package])]
+            )
+            with_systemdsystemunitdir=no],
+           [with_systemdsystemunitdir="$def_systemdsystemunitdir"]
+     )]
+)
+AS_IF([test "x$with_systemdsystemunitdir" != "xno"],
+      [AC_SUBST([systemdsystemunitdir], [$with_systemdsystemunitdir])]
+)
+AM_CONDITIONAL([HAVE_SYSTEMD], [test "x$with_systemdsystemunitdir" != "xno"])
+
 # Check for libraries
 AX_CHECK_OPENSSL([], [AC_MSG_ERROR(["openssl required and not found"])])
 AC_CHECK_HEADER(experimental/filesystem, [],
@@ -164,6 +185,18 @@
 AS_IF([test "x$AUTHORITY_CERTIFICATES_LIMIT" == "x"], [AUTHORITY_CERTIFICATES_LIMIT=10])
 AC_DEFINE_UNQUOTED([AUTHORITY_CERTIFICATES_LIMIT], [$AUTHORITY_CERTIFICATES_LIMIT], [Authority certificates limit])
 
+AC_ARG_ENABLE([ca-cert-extension],
+              AS_HELP_STRING([--enable-ca-cert-extension],
+                   [enable CA certificate manager \
+                    Only IBM specific])
+)
+
+AM_CONDITIONAL([CA_CERT_EXTENSION], [test "x$enable_ca_cert_extension" == "xyes"])
+
+AS_IF([test "x$enable_ca_cert_extension" == "xyes"],
+      [AX_APPEND_COMPILE_FLAGS([-DCA_CERT_EXTENSION])],
+      [AC_CONFIG_FILES([bmc-vmi-ca/Makefile])])
+
 # Create configured output
 AC_CONFIG_FILES([Makefile test/Makefile])
 AC_OUTPUT