PKI Masterclass: Real-World Lessons and Architecture Review

Module 1 · The Threat Landscape and the Urgency of Migration (45 min)

Recent threat trends (phishing-as-a-service, deepfakes, attacks targeting keys). The quantum threat to public-key cryptography and the NIST 2030 deadline. Why large-scale cryptographic migration has never been tested at this level. What this concretely means for an existing PKI.

Module 2 · PKI Architectures in Production: Beyond the Standard Model (1 h)

The real roles of CAs (Root, Intermediate, Secondary, Issuing) and why the distinctions matter in practice. Two-tier vs three-tier architectures depending on context (standard enterprise vs finance/government). Multi-root PKI and cross-certification (Federal Bridge model) vs simply adding an external root CA to the trust store — the security implications of each choice. Cloud-managed PKI (Azure AD CS, AWS Private CA) and air-gapped PKI (defence, critical infrastructure): when each model is the right fit.

Module 3 · Private Key Protection and HSMs (1 h)

Why file-based storage remains risky, even when encrypted, in constrained industrial/IoT environments. What an HSM really brings: internal key generation and cryptographic operations, tamper resistance, quorum-based access control (M-of-N), backup through secret sharing (Shamir). Case study: activating an HSM-protected Root CA with multi-officer approval.

Module 4 · Operational Hygiene for a Living PKI (1 h)

Key rotation: NIST-recommended frequencies by CA level (root, subordinate, end entity). Automatic revocation at each renewal. OCSP vs CRL: the availability/security trade-off and the single-point-of-failure question. Reliable time synchronisation in isolated environments (GPS/NTP) — an often-overlooked prerequisite. Enrollment interfaces for users and devices: balancing automation and human intervention.

Module 5 · Certificate Lifecycle Management — Managing PKI at Scale (1 h 15 min)

Why CLM becomes essential beyond a certain volume of certificates. Automated discovery (network scanning, agents, API integration with internal/external CAs) and centralised inventory. Compliance checks (detection of weak keys, self-signed certificates, excessive lifetimes). Automation and ITSM/SIEM integration. Expiry alerts and audit trail. Overview of market solutions (Venafi, Keyfactor, Entrust, Sectigo, DigiCert, CertSecure) — selection criteria, no one-size-fits-all recommendation.

Module 6 · Automated Enrollment Protocols (45 min)

EST, SCEP and ACME compared: use cases, security level, current adoption. Why ACME now dominates public TLS and is gaining ground in the enterprise, while SCEP remains the standard for mobile/IoT (MDM). Active Directory auto-enrollment: strengths and limitations in a pure Microsoft environment.

Module 7 · PKI Compliance and Governance (1 h)

Building a Certificate Policy and a Certification Practice Statement (CP/CPS). Overview of applicable frameworks: eIDAS, ISO 27001, NIST 800-53, ETSI EN 319 411, WebTrust, and sector-specific standards (PCI-DSS, GSMA SAS-SM for eSIM). Organising audits (compliance, security, operational) and the expected documentation (security strategy, risk map, RACI matrix).

Module 8 · Testing Your PKI Resilience (30 min)

Business continuity and disaster recovery plans applied to a PKI: simulating a CA compromise. Three levels of testing — tabletop exercise, partial simulation, full-scale exercise — and what each one validates (RTO/RPO, procedures, crisis communication).

Case study — 12 real-world incidents that shaped PKI history.

Wrap-up · Summary and Discussion (30 min)

Group review of the most common pitfalls encountered in real-world deployments; PKI maturity self-assessment grid (40% technical / 60% process, based on the ratio observed in the field).