Enterprise PKI and Certificate Automation
Expertise: Enterprise Technology & AI / Identity & Cybersecurity / Software
The situation
The organization runs a private PKI on Active Directory Certificate Services that has grown over the years: a root and issuing certificate authorities of different ages, many certificate templates with unclear owners and permissions, revocation information that is not always reachable, and certificates renewed and deployed by hand across many services.
At the same time, publicly trusted TLS certificates are getting shorter lives. Under the CA/Browser Forum schedule the maximum validity is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Renewals that once happened once a year now come several times a year, and manual handling no longer keeps up.
The approach
Assess the PKI. Review the certificate authority hierarchy, CA health and key protection, the templates and their enrollment permissions (including the known classes of Active Directory Certificate Services misconfiguration, ESC1 and later), and the publication of revocation information through CRL distribution points, AIA and, where used, an Online Responder.
Design the target. Agree a hierarchy that fits the organization, typically an offline root and online issuing CAs; a reduced, documented set of templates; autoenrollment for domain-joined systems; and certificates for managed devices through Microsoft Intune, either with SCEP or PKCS profiles and the Certificate Connector for Microsoft Intune, or with Microsoft Cloud PKI anchored to the existing root.
Automate the lifecycle. Keep an inventory of certificates and the services that depend on them. Build a controlled workflow for renewal, deployment and endpoint validation, using automated enrollment protocols where the issuing platform supports them, with the permissions and approval steps appropriate to each service.
What an engagement can deliver
- PKI assessment: hierarchy, templates, permissions, revocation publication and key protection
- Target PKI design and a migration plan for the CA hierarchy and templates
- Certificate inventory and dependency mapping
- Device certificate delivery through Intune, with SCEP, PKCS or Microsoft Cloud PKI
- Automated renewal, deployment and validation with operational logging
- Exception reporting, runbooks and operating instructions
How the result is evaluated
Check that certificates chain to the intended root, that revocation information is published and reachable, and that templates grant enrollment only to the intended principals. For each service in scope, check the deployed certificate, its binding, trust behavior and application availability after renewal. Record unsuccessful checks and stop or escalate according to the agreed procedure.
Scope follows the actual requirement
Inputs, system access, responsibilities and acceptance criteria are agreed for each project.