Stay Updated With The Best Practices For Modern Public Key Infrastructure

Introduction

Public Key Infrastructure (PKI) is a vital part of your organization’s security, and many PKI deployments still running today are more than a decade old. The use cases, threats, and standards around PKI have changed substantially since those environments were first built, and organizations now rely on PKI to secure far more than internal web servers: cloud workloads, DevOps pipelines, IoT device fleets, and a distributed workforce all depend on it. This post covers where modern PKI gets used, the best practices that keep a PKI deployment secure and auditable, how to choose between in-house and managed PKI, and how Encryption Consulting’s Managed PKI applies these practices for organizations that want to offload the operational burden.

Quick Answer: Modern PKI Best Practices

A modern PKI stays secure through proper planning, skilled or outsourced administration, regular audits, FIPS 140-3 Level 3 HSM-backed key storage, a documented Certificate Policy and Certificate Practice Statement, and a controlled Root CA key ceremony. Organizations that skip these steps are the ones most likely to face an unplanned certificate outage or a failed compliance audit.

Key Takeaways

• PKI now secures cloud workloads, DevOps pipelines, IoT fleets, and Zero Trust architectures, not just internal web servers.
• Root and Issuing CA private keys belong in FIPS 140-3 Level 3 validated HSMs, never on general-purpose servers.
• A documented Certificate Policy (CP) and Certificate Practice Statement (CPS) are what an auditor or partner will ask for first.
• Shrinking certificate lifetimes under the CA/Browser Forum’s SC-081v3 schedule make manual certificate tracking increasingly unworkable.
• Organizations without dedicated PKI expertise are generally better served by a managed PKI provider than an understaffed in-house build.

Why This Matters Now

Certificate lifetimes are shrinking on a fixed schedule. Under CA/Browser Forum Ballot SC-081v3, approved April 11, 2025, publicly trusted TLS certificate validity drops from 398 days to 200 days starting March 15, 2026, then to 100 days from March 15, 2027, and finally to 47 days from March 15, 2029 onward. A PKI that depended on manual tracking at a 398-day cadence will not survive a 47-day one.

The cost of getting this wrong is already visible. DigiCert’s Trust Pulse Survey, published July 2, 2025, found that nearly half of enterprises experienced a certificate-related outage in the past year, that 18.5% of affected organizations reported losses exceeding $250,000, and that 37.5% of incidents were tied specifically to expired certificates. Every one of those failures traces back to a best practice covered below that was skipped.

Modern Enterprise PKI Use Cases

PKI no longer just protects a handful of internal web servers. Today’s most common enterprise use cases include:

• Web and application servers:

  Enterprises need an advanced level of authentication and encryption across every website and application in their environment, on-premises and in the cloud, including behind the firewall. Trusted client-server authentication is achieved using an SSL/TLS certificate to encrypt communication over the internet.

• DevOps containers and code:

  Engineering teams incorporate compliant certificate processes into their regular workflow with code signing certificates and high-volume, short-lifespan SSL certificates, keeping containers, the code they run, and the production applications that use them verifiably intact.

• Public-cloud certificate management:

  A centralized certificate management solution manages certificates automatically across both cloud and on-premises environments, so applications keep running without an expired certificate taking them down.

• Zero Trust security:

  PKI certificates and key pairs strengthen digital identity verification and secure connections between entities beyond the traditional firewall perimeter, which is a core requirement of a Zero Trust security strategy.

• Internet of Things (IoT) devices:

  Building, scaling, and managing an IoT ecosystem requires strong identity authentication and remote security deployment across every connected device. The rapid growth of IoT is driving demand for internet of things public key infrastructure (IoT PKI), since devices need digital identities to operate safely at scale.

• Hybrid and remote workforces:

  A distributed workforce needs certificates tracked centrally regardless of where an employee or device is located. A modern PKI platform automates that tracking and removes the manual overhead of managing certificates across locations.

• Multi-cloud environments:

  Organizations moving to the cloud need strong authentication for their devices and users across increasingly diverse, multi-cloud environments. PKI is standards-based, widely adopted, and flexible enough to secure enterprise systems, cloud storage, email and document signing, virtualization, and DevOps pipelines from a single trust framework, and it scales to accommodate additional users, devices, and demand as an organization grows.

The public key infrastructure (PKI) itself is a set of hardware, software, policies, and procedures for creating, managing, distributing, and updating digital certificates over time. It has been the backbone of internet security for decades, and it continues to evolve into a flexible, scalable way to meet the data and device security needs created by IoT growth, cloud migration, and Zero Trust adoption. PKI eliminates reliance on passwords and complex manual authorization checks: devices exchange public keys and authenticate each other directly, while digital certificates minimize data leakage and impersonation risk through point-to-point encryption and mutual authentication. Certificates also validate software and firmware updates, making it harder for an attacker to push a malicious update onto the network.

Choosing the Right PKI Approach for Your Use Case

Not every use case carries the same security impact or operational effort. The table below maps common PKI use cases to who should typically own them.

Use Case	Security Impact	Operational Effort	Automation Fit	Recommended Owner
Web/application server TLS	High	High at scale	Very high (ACME, SCEP, EST)	Platform/Infrastructure team
DevOps code signing	High	Medium	High (CI/CD integration)	DevOps/Engineering
Public-cloud certificate management	High	Medium to high	High	Cloud/Platform team
Zero Trust device/service identity	Very high	High	High	Security Architecture
IoT device identity	Very high	Very high at scale	Medium to high	Security Architecture + Platform team
Root CA / key ceremony	Critical	Low frequency, high stakes	Low (intentionally manual)	PKI Administrators + CISO sign-off

Modern PKI Best Practices

Most PKI failures trace back to a handful of missed fundamentals. The best practices below are what separate a PKI deployment that survives an audit from one that generates an unplanned outage.

• Plan before you deploy:

  A detailed deployment plan is a prerequisite, not an afterthought. Security leaders who frame certificate management as a business enabler, tied to digital trust and uptime rather than a pure IT cost center, consistently win more budget and executive support for getting PKI fundamentals right the first time.

• Staff it with skilled resources:

  PKI is critical infrastructure, so it needs to be implemented and operated by people who understand it. Organizations without that expertise in-house are better served outsourcing PKI operations to a trusted managed PKI provider than running it understaffed.

• Audit the PKI regularly:

  A regular, scheduled audit of the CA hierarchy, issuance policies, and certificate inventory surfaces security gaps before an attacker or an auditor finds them first.

• Store certificates and keys securely:

  Attackers use a range of techniques to detect and extract keys while they are in use or in transit. Storing CA private keys in FIPS 140-3 Level 3 validated HSMs, rather than on general-purpose servers, is non-negotiable for a Root or Issuing CA.

• Understand your use cases first:

  Many organizations design and deploy a PKI without first mapping out their actual use cases. Understanding what the organization actually needs to secure, before finalizing PKI design and deployment, determines whether the resulting architecture fits or has to be rebuilt later.

• Run a formal Root Key Ceremony:

  Standing up a Root Certificate Authority (CA) is effectively creating a master key for the organization’s entire trust chain. A formal Root CA key ceremony records the event and each participant’s role, giving the organization a documented, auditable basis for trusting that root going forward. Dedicating an HSM (Hardware Security Module) to the Root CA is a decision that has to be made before any other PKI component is deployed.

• Document Certificate Policies and Practices:

  A PKI is only as trustworthy as the governance behind it. Many organizations deploy PKI as a pure project requirement and never document the policies and procedures that are supposed to govern it, which becomes a liability the first time an auditor or a partner organization asks for proof of process.

• Maintain a Certificate Policy (CP):

  A CP is the document that sets out the rights, duties, and obligations of each party in the PKI. It typically carries legal weight and is usually published publicly by CAs on their website.

• Maintain a Certificate Practice Statement (CPS):

  A CPS documents what actually happens in practice to support the policy statements made in the CP. It can carry legal effect in limited circumstances and gives auditors and relying parties a way to verify the PKI operates the way its policy claims.

• Build in crypto-agility:

  A modern PKI should be able to rotate algorithms and key sizes without a ground-up rebuild. Running a cryptographic discovery and inventory pass with CBOM Secure identifies every certificate, key, and algorithm in use today, which is the starting point for any post-quantum migration plan.

Managed PKI vs. In-House PKI: Pros and Cons

Neither approach is universally correct. The right choice depends on whether the organization already has dedicated PKI expertise, and how much operational risk it is willing to hold internally.

In-House PKI

Pros: full direct control over the CA hierarchy and business processes; no dependency on a third party for day-to-day operations; certificate data never leaves the organization’s own infrastructure.

Cons: requires dedicated, specialized PKI staff that is difficult to hire and retain; the organization bears the full cost of HSMs, audits, and key ceremonies; a short-staffed team is the most common root cause of the outages the DigiCert survey above documents.

Managed PKI

Pros: CA keys are held in FIPS 140-3 Level 3 validated HSMs from day one; the provider follows audited, repeatable procedures instead of ad hoc processes; the organization gets PKI expertise without having to hire and retain it directly.

Cons: introduces a vendor relationship that has to be managed; the organization still needs enough internal PKI literacy to define policy and review the provider’s work; migrating away from a managed provider later requires planning.

Who Should Care About This

PKI best practices touch more roles than the team that operates the CA. Here is what each role should take away.

PKI Administrators

Own the Root Key Ceremony documentation, the certificate inventory, and the audit calendar. Action item: confirm every CA private key sits in a FIPS 140-3 Level 3 validated HSM, not a general-purpose server.

Security Architects

Own how PKI fits into the broader Zero Trust and machine-identity architecture. Action item: map which use cases in the decision table above are still running on manual issuance and prioritize automation for the highest-security-impact rows first.

Platform Teams

Own the automation tooling that issues and renews certificates for web servers, containers, and cloud workloads. Action item: confirm renewal automation can handle the CA/Browser Forum’s 200-day and 100-day validity windows before they take effect.

Compliance Teams

Own the evidence that the PKI operates the way its Certificate Policy claims. Action item: verify a current Certificate Practice Statement exists and matches what audits actually observe in practice.

CISOs

Own the build-versus-buy decision and the budget case for it. Action item: weigh the pros and cons above against current staffing, and treat a certificate outage risk assessment as part of the standard annual risk review, not a one-time project.

Our Take: How Encryption Consulting Supports Modern PKI

Encryption Consulting LLC can fully offload the Public Key Infrastructure environment your organization depends on, building and managing PKI across on-premises, cloud, or hybrid infrastructure. We deploy and support that PKI using a fully developed, tested, and audited set of procedures. We do not require administrative rights to your Active Directory, and control over your PKI and its business processes always stays with you.

For security, CA keys are held in FIPS 140-3 Level 3 validated HSMs, hosted either in your own secure datacenter or in ours. If your organization needs certificate lifecycle management, code signing, or a fully managed cloud PKI handled at scale, PKI-as-a-Service and CertSecure Manager are built to work together rather than as separate, disconnected tools. For organizations planning ahead of the CA/Browser Forum’s shrinking validity windows and eventual post-quantum migration, our PQC Center of Excellence and CBOM Secure cryptographic inventory build the crypto-agility a shrinking-lifetime PKI now requires. Encryption Consulting also offers PKI assessment, design, and implementation services, along with hands-on PKI automation guidance, to help identify weaknesses in an existing environment and build a roadmap to close them. For further reading, see this independent overview of PKI securing a variety of use cases in today’s digital organizations.

Conclusion

Modern PKI has to secure far more than a handful of internal servers: cloud workloads, DevOps pipelines, IoT fleets, and a distributed workforce all depend on the same trust chain, and that trust chain now has to keep up with certificate lifetimes shrinking toward 47 days. The best practices that make it reliable have not changed even as the use cases have multiplied: plan before deploying, staff it properly or outsource to a team that already has, audit regularly, protect keys in FIPS-validated HSMs, and document the policies that govern how the PKI actually runs. Organizations that treat PKI as ongoing operational discipline, owned across PKI administrators, security architects, platform teams, compliance, and the CISO, rather than a one-time project, are the ones that avoid the outages and audit failures that catch everyone else off guard.

Frequently Asked Questions

What are the most important best practices for managing a modern PKI?

The most important practices are proper planning before deployment, staffing the PKI with skilled personnel or a managed provider, regular audits, storing CA keys in FIPS 140-3 Level 3 validated HSMs, and maintaining a documented Certificate Policy and Certificate Practice Statement.

What HSM validation level should protect a Root CA’s private key?

A Root CA’s private key should be stored in a FIPS 140-3 Level 3 validated Hardware Security Module (HSM) rather than on a general-purpose server. This is one of the most critical decisions made before any other PKI component is deployed.

What is the difference between a Certificate Policy and a Certificate Practice Statement?

A Certificate Policy (CP) sets out the rights, duties, and obligations of each party in the PKI and is usually published publicly. A Certificate Practice Statement (CPS) documents what actually happens in practice to carry out that policy, giving auditors and relying parties a way to verify the PKI operates as claimed.

Why does PKI governance matter more for enterprise teams today than it used to?

Certificate lifetimes are shrinking under the CA/Browser Forum’s SC-081v3 schedule, from 398 days down to 47 days by 2029, while PKI now secures cloud workloads, IoT fleets, and Zero Trust architectures in addition to web servers. That combination makes ungoverned, manually tracked PKI far more likely to cause an outage than it was a decade ago.

What risks increase when certificate and key management is handled manually?

Manual tracking increases the risk of missed renewals, expired certificates causing outages, keys stored outside a validated HSM, and undocumented policies that fail an audit. DigiCert’s July 2025 Trust Pulse Survey found nearly half of enterprises had a certificate-related outage in the past year, with over a third tied specifically to expired certificates.

Which teams should own PKI governance and daily operations?

PKI administrators typically own daily operations and the certificate inventory, security architects own how PKI fits into the broader Zero Trust strategy, platform teams own renewal automation, compliance owns the CP/CPS evidence trail, and the CISO owns the build-versus-buy decision and its budget.

What should be audited or monitored regularly in a PKI environment?

Regularly audit the CA hierarchy and issuance policies, the full certificate inventory against actual usage, HSM access logs, and whether the Certificate Practice Statement still matches what the PKI does in practice. Continuous monitoring for approaching expirations should run alongside, not instead of, these periodic audits.

How does this guidance change for cloud, hybrid, or multi-CA PKI environments?

The same fundamentals apply, but multi-CA and hybrid environments add the challenge of keeping policy, key storage, and audit standards consistent across every CA in the hierarchy. A cryptographic discovery and inventory pass is especially important here, since certificates in a multi-cloud environment are the ones most likely to go untracked.

Why do organizations choose a managed PKI service instead of running PKI in-house?

Organizations choose managed PKI when they lack the specialized staff to run it securely in-house, or want CA keys held in FIPS-validated HSMs and daily operations handled by a team following audited procedures, without giving up control over their own PKI business processes.