Public Key Infrastructure for Proven Identity, mTLS & Code/Token Signing
Public Key Infrastructure (PKI) issues and governs digital certificates so systems can prove identity, establish trust, and sign or encrypt safely.
SolveForce designs PKI with offline roots, intermediate issuing CAs, HSM-backed keys, and automated enrollment (ACME/EST/SCEP)—so certificates across servers, services, users, devices, code, and APIs are short-lived, automated, and auditable.
PKI in the SolveForce system:
🔑 Keys → Key Management / HSM • 🔐 Crypto → Encryption
🔓 Access → IAM / SSO / MFA • 🛡️ Zero Trust → ZTNA • SASE
☁️ Platforms → Cloud • 🖧 Fabric → Networks & Data Centers
📊 Evidence/Automation → SIEM / SOAR • 🔏 Data → DLP
🎯 Outcomes (What a strong PKI delivers)
- Proven identity everywhere — servers, services (APIs), users, devices, code, and email.
- mTLS at scale — short-lived service certificates with automatic rotation.
- Automation-first — ACME/EST/SCEP + policy “as code”; zero manual ticket churn.
- Non-exportable CA keys — HSM/KMS custody with quorum/dual-control and evidence. → Key Management / HSM
- Audit-ready — full issuance/renewal/revocation timelines for SOC 2/ISO/PCI/NIST/CMMC.
🧱 PKI Building Blocks (Spelled out)
- Root CA (offline) — air-gapped, HSM-resident key; used rarely to sign intermediates.
- Intermediate / Issuing CAs — online CAs that sign end-entity certs (serverAuth, clientAuth, code, email).
- Registration Authority (RA) — validates identities/CSR metadata before issuance (can be automated).
- Repositories — certificate chain and policies; CRL (Certificate Revocation List) and OCSP responders.
- Profiles & Policies — OIDs, SAN rules, EKUs (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping), key sizes, lifetimes.
- HSM-backed keys — root/intermediate private keys non-exportable; ceremonies with M-of-N quorum. → Key Management / HSM
🔐 Certificate Types & Common Uses
- Server/Service TLS — web/API endpoints; TLS 1.3, OCSP stapling, HSTS, short-lived certs. → Encryption
- Client/mTLS — service-to-service identity, device certs, user auth for private apps. → ZTNA
- Device/IoT — bootstrap identity via SCEP/EST, EAP-TLS (Wi-Fi), per-app VPN. → MDM / UEM
- Code/Container Signing — CI/CD artifact & image signing (Cosign/Sigstore); attestations with provenance.
- Email (S/MIME) — sign/encrypt messages; automate enrollment/renewal via IdP mapping. → IAM / SSO / MFA
- Timestamping — notarize build/sign events for long-term validation.
Algorithms & sizes
- Ed25519 / ECDSA P-256/P-384 for signing; RSA-2048/3072 for legacy.
- Use AEAD ciphers (AES-GCM/ChaCha20-Poly1305) at transport/content layers. → Encryption
⚙️ Enrollment & Automation (No tickets, no drama)
- ACME — automated issuance/renewal for servers & services (HTTP-01/DNS-01/TLS-ALPN-01); great for short-lived certs (hours–days).
- EST (Enrollment over Secure Transport) — secure device/service enrollment with mutual auth and re-enroll.
- SCEP — legacy device enrollment (network gear, printers, OT/ICS).
- SCM/IdP glue — map groups/roles to profiles and SANs; drive issuance from CI/CD or K8s operators; log everything to SIEM. → SIEM / SOAR
Policy as code: keep PKI profiles, ACLs, and issuance rules in version control; PR-based changes with approvals.
🧭 Validation & Revocation (Make trust provable)
- Chains — publish complete chain (server → intermediate → root) and pin to trust stores.
- OCSP / OCSP stapling — low-latency revocation checks; staple responses at edge.
- CRLs — scheduled for offline contexts; keep lists compact; delta-CRLs for frequency.
- CT (Certificate Transparency) — for public web PKI (not private/internal).
- Short lifetimes — reduce reliance on revocation: hours–days for services, weeks–months for users/devices.
☁️ Cloud, K8s & Service Mesh Patterns
- Cloud — public TLS via provider ACM; private mTLS with your internal CA; attach cert managers to Direct Connect/ExpressRoute/Interconnect hubs for deterministic paths. → Direct Connect
- Kubernetes — cert-manager + ACME/ISTIO mTLS; rotate SPIFFE/SVID-like service identities.
- API Gateways — mutual TLS for partner APIs; JWKS for token verification.
- Secrets — never write private keys to images; use CSI drivers/vault sidecars. → Key Management / HSM
🛡️ Security & Governance (No single person can burn it down)
- HSM custody — root/intermediate keys in FIPS-validated HSMs; non-exportable; tamper alarms to SIEM. → SIEM / SOAR
- Quorum / dual-control — ceremonies for create/sign/destroy; M-of-N key cards + change IDs.
- Separation of duties — Security Officer, Crypto Officer, Auditor; JIT elevation via PAM with session recording. → PAM
- Audit streams — issuance/renewal/revocation, profile edits, RA approvals; WORM retention.
- Backups & DR — HSM backups (wrapped or split-key), off-site sealed storage; restore drills quarterly.
📐 SLO Guardrails (Experience & Safety You Can Measure)
| SLO | Target (Recommended) | Notes |
|---|---|---|
| ACME/EST issuance (p95) | ≤ 5–15 s | From CSR to cert |
| Renewal success rate | ≥ 99.5% | Auto-renew 30–50% lifetime |
| OCSP responder latency (p95) | ≤ 100–200 ms | Geo-distributed responders |
| CRL publish interval | ≤ 15–30 min (delta) | Full daily; tighter if policy needs |
| Service cert lifetime | ≤ 7–30 days (services) | Favors revocation-free ops |
| Audit export completeness | 100% of CA/RA/key events | Immutable/WORM store |
| CA key availability | ≥ 99.99% (issuing tier) | HA issuing CAs; offline root |
Publish SLO dashboards; alert on issuance lag, OCSP failures, revocation backlog, and ceremony exceptions.
🧪 Common Pitfalls (and Fixes)
- Long-lived certs → use short-lived + automation; reduce revocation pain.
- Manual renewals → adopt ACME/EST; remove calendar-based toil.
- Private key sprawl → HSM/KMS custody; prevent export; sign via service.
- Wildcard misuse → prefer SANs or service-specific certs; tighten SAN generation rules.
- Mixed trust stores → standardize trust anchors per platform/team; routinely reconcile drift.
- CT confusion → only for public web PKI; don’t leak internals to CT logs.
📦 Use-Case Blueprints
A) mTLS for Service Mesh
- ACME/EST to issue short-lived service certs; rotate automatically; JWKS for token fallback; SIEM monitors renewals.
→ Cloud • Encryption
B) Device Identity (EAP-TLS / per-app VPN)
- SCEP/EST via MDM; device certs bound to posture (EDR/UEM). Access gated by ZTNA/SASE.
→ MDM / UEM • ZTNA • SASE
C) Code & Container Signing
- HSM-backed signer service; dual-approval; Cosign/Sigstore attestation; verify in admission controllers.
→ Key Management / HSM
D) Partner API Mutual Auth
- Issue partner client certs with strict EKU/OU; per-partner CRLs/OCSP; rate limit + DLP at the edge.
→ DLP
📜 Compliance Mapping (Examples)
- PCI DSS — key protection, revocation, evidence of issuance & access controls.
- ISO 27001 / 27002 — cryptographic controls, key management, logging.
- HIPAA — encryption & integrity for ePHI; access and audit controls.
- NIST SP 800-57 / 800-52 / 800-53 (SC-12/SC-13) — key lifecycles, TLS profiles, crypto services.
- CMMC — certificate-based auth, audit logs, key custody.
All evidence streams to SIEM; SOAR handles emergency revoke/disable/rollover playbooks. → SIEM / SOAR
🧰 Implementation Blueprint (No-Surprise Rollout)
- Intent & inventory — who needs certs (servers, services, users, devices, code), where, and how often.
- Hierarchy — offline root, HA intermediates (per env/tenant), HSM custody, policy OIDs. → Key Management / HSM
- Profiles — EKUs, SAN rules, key types/sizes, lifetimes (short-lived by default).
- Enrollment — ACME/EST/SCEP, IdP/CI/CD/K8s integrations; RA checks automated.
- Revocation — OCSP/CRL, stapling, delta CRLs; emergency revoke SOP.
- Observability — issuance lag, renewal rate, OCSP health, chain errors; SIEM dashboards. → SIEM / SOAR
- Compliance packs — policy docs, ceremony SOPs, M-of-N records, evidence exports.
- Game days — key ceremonies, OCSP failover, mass renewals, emergency revoke & re-issue.
✅ Pre-Engagement Checklist
- 🔑 HSM/KMS posture; M-of-N quorum, dual-control, ceremony plan.
- 🧾 Profiles & EKUs per use case (serverAuth, clientAuth, code, email).
- 🤖 Enrollment method per domain (ACME/EST/SCEP), CI/CD & K8s hooks.
- 🧭 Lifetimes & rotation cadences (short-lived preferred).
- 🛰️ OCSP/CRL hosting & latency targets; stapling at the edge.
- 🧪 Emergency revoke & bulk re-issue drills; rollback paths.
- 📊 SIEM dashboards and SOAR playbooks (revoke/disable/rotate).
- 🧾 Compliance targets & evidence formats.
🔄 Where PKI Fits (Recursive View)
1) Grammar — identities ride Connectivity & the Networks & Data Centers fabric.
2) Syntax — Cloud delivery patterns (mTLS, ACME, service mesh).
3) Semantics — Cybersecurity preserves truth; PKI proves identity and integrity.
4) Pragmatics — SolveForce AI flags expiry risk, failed chains, OCSP drift.
5) Foundation — consistent terms via Primacy of Language.
6) Map — indexed in the SolveForce Codex & Knowledge Hub.
📞 Launch PKI That’s Automated, Short-Lived & Auditable
Related pages:
Key Management / HSM • Encryption • IAM / SSO / MFA • ZTNA • SASE • Cloud • Networks & Data Centers • SIEM / SOAR • DLP • Knowledge Hub