Here is the honest situation. Here is the honest situation. Internal PKI rarely fails because the cryptography is wrong. The libraries are mature, the defaults are mostly sensible, and standing up an issuing authority is a short piece of work that any competent platform team can complete in a sprint. It fails because the thing that was installed was never turned into an operation, and the gap between those two states only becomes visible on the day something expires or somebody asks who holds the root key. The first failure is the hierarchy. The root is described as offline, which turns out to mean it lives on a machine in a cupboard that is occasionally patched, or in a safe two people can open without a witness, and nobody can produce a record of what it has signed. Its lifetime was set by a default and never written into a plan, so the succession will be discovered rather than scheduled. Underneath it sits one issuing intermediate for everything, because that is the simplest thing to operate, which means production, test and any partner trust all rest on a single online key, and rotating it is an estate-wide event nobody will ever put in a change window. That intermediate is usually unconstrained, so it can sign a certificate for any name in the world including names the organization does not own, and the only boundary is the intention of whoever wrote the issuance profile. The second failure is the identity. Most internal certificates carry a name that describes where the workload is running rather than what it is, a host, a node, an address, sometimes a common name field that validators stopped treating as authoritative long ago. So the identity changes whenever the scheduler moves the process, no durable authorisation policy can be written against it, and the policy that exists becomes an enumerated allow list which grows with every deployment and which nobody has ever pruned. Nothing maps the identity to an owning team, so when a certificate approaches expiry the first activity is archaeology through repository history. The third failure is issuance. The moment issuance is automated the authority becomes an endpoint that mints identity on request, and in most estates the thing standing between an attacker with network reach and a valid production certificate is a shared bootstrap credential baked into an image and readable by anything on the node. That credential never appears on a risk register because it looks like plumbing. Where attestation does exist, nobody has written down what it actually trusts, so the question of what an attacker obtains by compromising a node agent gets researched during the incident. Private keys are generated centrally and written to a shared volume, which means every other process, every backup and every crash dump has a copy, and a certificate then proves only that something on that node had file access. The fourth failure is renewal, and specifically reload. Renewal gets automated first and reload gets forgotten, so a process that read its certificate once at start-up holds that material in memory for its whole life. The renewal succeeds, the file on disk is current, every dashboard is green, and the service keeps presenting an expired certificate until a client refuses the handshake. Nothing in the renewal system can see it, because the renewal system checks the file, and the file is the one thing that is telling the truth about a state the process is not in. Renewal is also scheduled too close to expiry, usually as a fixed number of days rather than a fraction of lifetime, so a single refused request during a maintenance window has no margin behind it. Alongside the automated estate sits a population of hand-installed certificates, each a small defensible exception on the day it was created, collectively the part of the estate with no owner and no renewal path. The fifth failure is trust distribution, which is where teams cause their own worst outage. If a service starts presenting a certificate from a new intermediate before every consumer holds the new anchor, every consumer refuses at the same instant, with no partial failure to warn anybody first. The safe order takes weeks of patience nobody budgeted, and the long tail is always the consumers nobody knew were consumers. Enforcement has the mirror problem. Permissive mode is the right first step, and then nothing forces the second step, because permissive looks perfectly healthy on every dashboard, so the estate carries the entire operating cost of certificates without the guarantee they were bought for. And where strict mode is claimed, it is frequently half true: the server requests a client certificate, logs the subject and completes the handshake regardless of whether the certificate is valid, absent, expired or signed by an unknown authority. Nobody runs the negative test, because the positive path works and no engineer volunteers to break a working service. The sixth failure is expiry itself, which is an outage class rather than an administrative task. Every organization that has had a certificate outage discovers afterwards that the certificate was not in the inventory, because the inventory was built from the issuing authority or from configuration and the certificate came from neither. The alerting is a single threshold into a shared channel that everybody has muted. And the revocation position is dishonest: a procedure exists, it has never been exercised, many client libraries do not check status by default, proxies soft-fail when the responder is unreachable, and a hard-fail configuration would make the responder a new single point of failure for every connection. So the organization believes a leaked key can be withdrawn on demand, when what actually happens is that lifetimes shrink, the issuing intermediate is rotated and the affected population is reissued, an operation nobody has rehearsed and everybody will be doing for the first time under pressure. Where teams fall short is predictable: a root nobody can account for, an intermediate that can sign anything, an identity that names a host, a registry that is a stale spreadsheet, issuance guarded by a credential in an image, keys on shared volumes, renewal without reload, trust rotated in the wrong order, mutual authentication that is half true, an inventory of what should exist, and a revocation plan that will not work on the day.
This Kit removes the guesswork. It is internal certificate authority and workload certificate operation written as adopt-ready controls you personalize in a weekend, with the evidence a head of platform engineering, a security function, an internal auditor or an incident review actually examines.
What you get, the moment you buy
Grounded in platform and infrastructure engineering practice as it is actually run inside estates where thousands of workloads authenticate to each other continuously and an expiry is an outage. Editable Word and Excel files. This is a practitioner method and it is honest about what certificates can and cannot give you, including where revocation does not work.
What one control looks like
This is the opening control, where the hierarchy either becomes something you can prove custody of or stays a private key nobody can account for. All 18 are built to this depth.
Why this is not another template pack
- The evidence is the point. A running certificate authority and a renewal client are not evidence. This tells you what a head of platform engineering, a security function, an internal auditor or an incident review examines and where teams fall short, for every control.
- The hard specifics built in. An offline root defined as a witnessed ceremony with a recorded lifetime and a named succession point, issuing intermediates scoped one per environment and trust domain with lifetimes far shorter than the root, path length zero and name constraints proven by a negative test against the deployed proxy and runtime versions, a workload identity in a URI subject alternative name that survives a reschedule with the common name carrying no authorisation meaning, a registry fed by issuance so no certificate exists without an owner, weekly naming conformance so policy matches a segment rather than an allow list, attestation binding each request to a platform-asserted property with the blast radius written down and signed off per platform, keys generated in the workload and delivered over a process-scoped channel with weekly mode and owner scans, renewal at a fraction of lifetime with jitter and a first-failure alert, verified reload read off a live connection rather than off the file, manual issuance refused with owner and expiry on every exception, three gated trust rotation stages measured from the wire, permissive to strict with an exit criterion in measurements and a published date, a four case negative test proving refusal rather than a logged warning, an inventory from active discovery reconciled against the authority, an expiry ladder with a different named recipient per rung, and an honest revocation position with a rehearsed break-glass reissue are written into the controls, not left generic.
- Built on real practice, not one person's opinion, grounded in how internal certificate authorities and workload identity actually hold together at scale and where that discipline usually breaks down.
- It compounds. This work shares its shape with service authorisation, change management, incident response and supplier assurance, so it feeds your wider platform operating model.
Who buys this
Platform engineering and infrastructure leads, site reliability engineers, security engineers and the engineering managers accountable for internal certificate authorities and service to service authentication, who have to say who holds the root key and what it has signed, what an intermediate is allowed to issue, what a workload identity actually means, what happens when an issuing key leaks, whether a renewed certificate is really being served, and which certificate in the estate is closest to taking a service down. Whether you are standing up an internal authority that has to be defensible from the first issuance or formalising one that has quietly worked for a long time and been evidenced by nobody, you save weeks and walk in with your hierarchy, identity, issuance, renewal, trust distribution and expiry controls structured.
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Does it cover the whole practice? Yes. Certificate authority hierarchy and trust boundaries, workload identity in the certificate, attested issuance and private key custody, automated renewal and the reload problem, trust distribution and mutual TLS enforcement, and expiry as an outage class with revocation and break-glass each have their own controls with their own evidence.
Is this tied to one cloud, one orchestrator or one certificate authority product? No. The controls are principle-level, the hierarchy and constraint discipline, the identity format rules, the attestation and key custody requirements, the renewal and reload method, the trust distribution ordering, the enforcement proof and the expiry regime, so they apply whatever you run on and whatever issues your certificates.
Does it tell me what lifetimes to use? No, and it should not. Every lifetime, renewal fraction, threshold, conformance target and cadence in the Kit is a number your organization sets and records. What the Kit gives you is the method, the evidence and the discipline that makes your own numbers defensible.
Does this cover secrets, vaults and workload tokens as well? No. This Kit is certificates for workloads. Secrets management, vaults, workload identity federation and short-lived tokens in delivery pipelines, and key management inside a cloud key service, are separate subjects with their own Kits.
What if it is not for me? A 30-day money-back guarantee.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com