Skip to content

47-Day Certificates Are Coming. Are You Ready?

Act Now →

Case Study

Fragmented PKI. Hidden Certificates. A Healthcare Roadmap Built for Scale

How Encryption Consulting assessed a Minnesota-based healthcare organization’s fragmented PKI environment, closed governance and visibility gaps, and delivered a remediation roadmap to automate lifecycle management across hybrid infrastructure.
Fragmented PKI. Hidden Certificates. A Healthcare Roadmap Built for Scale

Customer Profile

A Minnesota-based healthcare organization with 7,000+ professionals, serving millions across nations with home-based pharmacy services. The organization has operated for decades in pharmacy, treatment development, and disease research, with infrastructure spanning on-premises and cloud environments.

Industry

Healthcare, Pharmacy & Treatment Services

Engagement Type

PKI Assessment & Remediation Roadmap

Download Case Study

At a Glance Outcome

NIST 2.0

Cybersecurity framework driving the assessment

FIPS 140-2/3

Cryptographic module standards guiding key protection

Multi-CA

Vendor lock-in eliminated with multi-CA flexibility

Centralized

Certificate discovery and inventory recommended

The Enterprise

Challenges

The organization's PKI had grown organically to meet immediate security needs, but lacked a structured approach, formal governance, or centralized oversight. What started functional had become a patchwork that couldn't scale or be audited, and blind spots were accumulating across its hybrid environment.

No formal governance, CRL process, or backup procedures

No CP or CPS existed, CRL updates lacked structure, and CA databases had no regular backups. Without centralized oversight, certificate risks went untracked, exposing the organization to data loss and compliance penalties.
01 GOVERNANCE

Manual lifecycle management for thousands of certificates

Issuance, renewal, and revocation were all manual across thousands of certificates. This slowed operations and raised the risk of outages from expired certificates going undetected.
02 LIFECYCLE

Private keys stored in software without strong access controls

Root and Issuing CA private keys sat in software without strong access controls. This left the organization’s core cryptographic assets exposed to unauthorized access and compromise.
03 KEY SECURITY
The organization’s PKI environment had evolved to meet immediate security requirements, but without a compliance-focused strategy or centralized oversight, it left critical gaps that could lead to costly penalties.

Encryption Consulting

Engagement Summary · Encryption Consulting · PKI Services

Our Offered

Solutions

The engagement followed a phased approach: policy and standards review, stakeholder workshops, gap analysis against a custom PKI framework aligned with NIST 2.0 and FIPS 140-2/3, and a remediation roadmap for governance, automation, visibility, and key protection.

Capability 01

Assessment, Gap Analysis & Use Case Definition

Reviewed policies, data classification, and key management. Workshops defined use cases: client-server security, least privilege, centralized CLM, and strong cryptographic controls. Gap analysis benchmarked current state against NIST 2.0 and FIPS 140-2/3.

Capability 02

Governance, Policy & Multi-CA Flexibility

Evaluated multi-CA integration to eliminate vendor lock-in. The roadmap prioritized NIST SP 1800-16, 2048-bit keys, and least privilege, with policies to govern certificate management and phase out self-signed and wildcard certificates.

Capability 03

Certificate Lifecycle Automation & Alerting

Recommended automated lifecycle management to cut manual workload and outage risk. Defined real-time expiration alerts for proactive renewals and automated CA database backups for recoverability.

Capability 04

Centralized Inventory & Visibility

Recommended centralizing certificate inventory across hybrid environments into a single pane of glass to track status, ownership, and dependencies, close blind spots, and improve accountability.
The result was a clear remediation roadmap transforming a fragmented, manually managed PKI into a governed, automated, and visible certificate management framework aligned with industry standards and built to scale.

Encryption Consulting

Engagement Summary · Encryption Consulting · PKI Services

The Overall

Business Outcome

The PKI assessment gave the organization a clear path from fragmented, manual PKI operations to a centralized, automated certificate management framework built for long-term security and scalability.

01

Stronger security and key protection

Automated lifecycle management reduced manual work and prevented expired-certificate outages. Root and Issuing CA keys moved to HSM storage with defined roles and strong access controls.
02

Visibility and standardized operations

Centralized management provided visibility into certificate status, ownership, and urgency. Standardized CSR workflows replaced patchwork processes, with passwordless authentication across laptops, phones, servers, and IoT devices.
03

Foundation for future growth

Moved from fragmented PKI to a secure, scalable environment with proactive expiration monitoring. Next steps: automate deployment, integrate with identity and access management, and extend PKI to IoT security.

Discover Our

Latest Resources

  • Blogs
  • White Papers
  • Videos

PKI

clientAuth EKU Removal: Where mTLS Breaks and How to Migrate to Private PKI

Chrome and public CAs are pulling clientAuth from TLS certificates. See exactly where mTLS breaks, how to find your exposure, and how to migrate to PKIaaS.

Read more
Case-Studies
view all blogs
Why-the-Scariest-Certificate-Story-Is-the-One-Nobody-Sees
Why the Scariest Certificate Story Is the One Nobody Sees
Introducing-the-PQC Center of-Excellence:-A-Hands-On-Lab-for-the-Post-Quantum-Era 
Introducing the PQC Center of Excellence: A Hands-On Lab for the Post-Quantum Era 
We-Counted-Every-Format-CodeSign-Secure-Can-Sign
We Counted Every Format CodeSign Secure Can Sign

White Paper

The PQC Control Guide 2026

Access the complete whitepaper on PQC controls and enhance your encryption strategies today. Fill in your details to download.

Read more
Case-Studies
view all white papers
Cryptographic-Bill-of-Materials-(CBOM)-Solutions
Cryptographic Bill of Materials (CBOM) Solutions
The-Cert-Wars:-The-Race-Against-Expiry
The Cert Wars: The Race Against Expiry
Post-Quantum-Cryptography-for-Finance:-Threats,-Standards,-and-the-Road-to-2035
Post-Quantum Cryptography for Finance: Threats, Standards, and the Road to 2035

Video

The End of clientAuth in Public TLS: What It Breaks and How to Prepare

Explore expert insights on cybersecurity, PKI, and post-quantum readiness, with practical guidance to strengthen security and future-proof cryptography.

Watch Now
Case-Studies
view all videos
The-Claude-Mythos-Cryptanalysis-Findings-Explained:-What-AI-Found-in-HAWK-and-Reduced-Round-AES
The Claude Mythos Cryptanalysis Findings Explained: What AI Found in HAWK and Reduced-Round AES
Cryptographic-Posture-Management-Explained:-PQC,-Certificate-Lifetimes-&-the-CBOM
Cryptographic Posture Management Explained: PQC, Certificate Lifetimes & the CBOM
The-2029-Convergence:-Why-Microsoft,-Google,-and-Cloudflare-All-Chose-the-Same-PQC-Deadline
The 2029 Convergence: Why Microsoft, Google, and Cloudflare All Chose the Same PQC Deadline