A three-tier PKI that runs certificates on autopilot
A private certificate authority with an offline root, online intermediate and issuing CAs, and automated issuance, renewal and revocation across standard protocols.
- Client
- Enterprise security vendor
- Industry
- Cybersecurity
- Delivered
- 2026
- Platforms
- Admin console · REST API · Offline root CA tool
- Root, intermediate and issuing CAs
- 3-tier
- IETF standards implemented
- 5
The challenge
Certificates were issued by hand and tracked in spreadsheets, so renewals were missed and revocation was slow. The client needed its own trusted hierarchy with the controls auditors expect, offered to its own customers as a service.
Our approach
We designed a three-tier hierarchy with an air-gapped root created in a recorded key ceremony, and online intermediate and issuing CAs with path-length limits enforced down the chain. Around it we built certificate lifecycle automation, standard enrolment protocols and a multi-tenant console.
What we built
- Offline root CA with a guided key ceremony, kept apart from the online tiers
- TLS, client, S/MIME, code-signing, document-signing and device certificate profiles
- ACME and EST enrolment, an OCSP responder, and full and delta CRLs on a schedule
- RFC 3161 time-stamping authority for signed documents
- Automatic renewal of expiring certificates and PKCS#12 export
- Multi-tenant access control with roles, organisation-scoped API keys and audit logs
Technology
- Go
- PostgreSQL
- X.509
- ACME
- OCSP
- Next.js
Have a platform like this in mind?
Tell us where you want to go. We'll come back with senior engineers, a clear plan and honest numbers.
What happens next
- 1
A reply within one business day
A senior engineer reads your brief and replies with real questions, not a sales script.
- 2
A focused discovery call
Thirty minutes on your goals, constraints and what success should look like.
- 3
A clear, shareable plan
Scope, team shape, timeline and cost, written up so you can take it to your board.