Where this offering fits
Private PKI provides an issuance and trust framework for identities used by internal devices, workloads and applications. It suits a requirement to establish certificate policy and authority rather than merely catalogue existing certificates. Design around the relying systems and the trust they must accept, including devices that cannot easily change their configuration.
Architecture and rollout decisions
Define certificate profiles, identity proofing, authority hierarchy, enrolment methods and revocation. Decide where signing keys are held and who participates in sensitive administrative procedures. Availability needs include recovery of the authority and continued operation of dependent services. Before deployment, map trust-store changes and test a representative enrolment with the application or device owner; issuing a certificate alone does not demonstrate that the relying service trusts it.
An evaluation scenario for this offering
Use a test device with a documented owner and enrolment policy. Issue its identity, validate the chain at the relying application and exercise the approved revocation process. Include a device whose request lacks the required evidence so rejection can be reviewed. The team should be able to explain which authority made the trust decision and which records would support recovery, without exposing an operational private key in a demonstration or project report.
Evidence to request for this scope
- Agree authority and certificate-profile ownership separately from day-to-day server administration.
- Test the selected enrolment and revocation path with supported device models and application versions.
- Retain recovery instructions, key-custody responsibilities and an approved trust-store change record.