PKI implementation
The CA hierarchy, the certificate profiles and the issuance policies decide what your PKI will be able to do for the next ten years. Anlina designs that layer.
Why PKI projects reach production in poor shape
Most organizations arrive at the project with the software already chosen and the HSMs quoted. What tends to go unresolved is the CA hierarchy, the certificate profiles, the issuance and revocation policies, and the script for each key ceremony.
That layer gets treated as an annex to be completed after signing. Three years later it is exactly what boxes the organization in: a new use case appears and no profile covers it, revocation at scale turns out to be impractical, or migrating means starting over.
Approach
A PKI is designed once and lived with for years. We come in before the purchase where we can, and always before deployment, because hierarchy and policy decisions are the most expensive ones to reverse.
At close, your team keeps the written procedures, the script for each ceremony, the continuity plan, and the experience of having run them with us alongside. The point is that they can operate without calling us.
A typical engagement
- 01
Discovery
Mapping of use cases, planned integrations, regulatory constraints and real operational constraints.
- 02
Target-state design
CA hierarchy, certificate profiles, issuance and revocation policies, identity model, integrations.
- 03
Deployment support
Technical support during implementation, including HSM configuration, CA deployment and integration validation.
- 04
Key ceremonies
Design and execution of auditable ceremonies: root generation, key signing, scheduled rotations.
- 05
Operational handover
Operating documentation, runbooks, continuity plan and handover to the client's team.
Relationship with OT
In OT environments, PKI underpins device identity, firmware signing and operator authentication. When a client arrives through one of the two, the other usually shows up in the conversation.
PKI project under evaluation?
If you are considering an implementation or a redesign, the useful moment to talk is before the platform decision is closed.
Talk to Anlina