Running a private certificate authority and automating certificate issuance and renewal with step-ca, cert-manager, OpenBao PKI or FreeIPA, and how lifetimes, device identity and audit rules change the design.
Issuing and renewing TLS certificates for ingress and internal services in Kubernetes: cert-manager with ACME, a CA issuer, OpenBao or step-ca, trust distribution to pods, and monitoring expiry across clusters.
Giving every service its own short-lived certificate for mutual TLS: issuing from step-ca or OpenBao PKI, workload identity through provisioners and auth methods, rotation without restarts and what to do when the CA is unavailable.
Replacing scattered authorized_keys files with short-lived SSH user and host certificates from step-ca or OpenBao: login through the identity provider, principals and expiry, host trust and the audit trail compared with static keys.
Public TLS certificate lifetimes fall to 200 days in March 2026, 100 days in 2027 and 47 days in 2029. This page covers building a certificate inventory, ACME automation for public and private certificates, and moving internal services to short-lived certificates from your own CA.
Designing a PKI where the root never touches a network: an offline root, online issuing CAs in step-ca, OpenBao or FreeIPA Dogtag, key ceremonies, HSM or hardware key storage, CRL distribution inside the enclave and renewal planning.
Giving machines, gateways and sensors their own identity: issuing device certificates at provisioning, renewing them on devices with limited connectivity, revoking compromised devices and separating OT and IT trust chains.
Banks run certificates for internal services, payment links and staff devices under strict key management rules. This page covers issuing CA design, HSM-backed keys, certificate inventories for audits and separating PKI duties.
Agencies issuing certificates for internal systems on their own infrastructure: FreeIPA Dogtag for Linux estates, step-ca for automation, alignment with existing government PKI hierarchies and key custody rules.
PCI DSS v4 requires an inventory of trusted keys and certificates used to protect cardholder data in transit. This page covers building that inventory from your CA and scanners, keeping it current and pairing it with key management requirements.
What SC-17 asks for public key infrastructure certificates and how SC-12 key establishment applies, mapped to policies and issuance from a self-hosted CA, with the documentation assessors review for a federal system.
Requirements for a private CA: hierarchy and key storage, issuance protocols (ACME, SCEP-style enrollment, API), certificate profiles and lifetimes, revocation, high availability, inventory and expiry monitoring, and audit logging.
Questions for PKI vendors and implementation partners: root key ceremony, HSM support, automation coverage, revocation design, migration from an existing CA, certificate lifetime strategy and operational support.
Cost components of a self-hosted CA versus a managed PKI service: HSMs or cloud KMS, CA servers, automation work per platform, certificate lifecycle operations and the cost of outages from expired certificates.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.