PKI is a service, not only a certificate authority
A workable PKI connects identity proofing, certificate profiles, key management, issuance, status services, repositories, renewal, revocation and termination. Policy and technical design must support the intended relying-party decision throughout that lifecycle.
Areas of support
- Trust model and certification-path design
- Certificate Policy and Certification Practice Statement alignment
- X.509 certificate and extension profiles
- Registration, issuance, renewal, re-key and revocation processes
- Certificate revocation lists and OCSP service requirements
- Key generation, protection, activation and recovery decisions
- Repository, audit, logging and retention requirements
- Supplier specifications and independent design review
Typical outputs
PKI architecture
Trust anchors, authorities, roles, service components, interfaces and lifecycle flows.
Certificate profile
Fields, extensions, constraints, identifiers and policy linkage expressed unambiguously.
Lifecycle requirements
Controls and service levels for issuance, status, renewal, revocation and end-of-service.
Independent review
Findings on consistency between policy, design, implementation and supplier material.