Putting Nordlys Industries' PKI on a real footing after an expired-certificate outage, up the PKI staircase of eight steps: trust architecture, CA hierarchy and ceremony, certificate policy and CPS, enrollment and automation, inventory and discovery, renewal and revocation, use-case integration, and governance and agility. It starts from a three-year-old certificate nobody tracked, a root CA running as a VM with its key on disk, emailed CSRs, revocation checks switched off, one shared certificate for a batch of sensors and a forgotten 2011 pilot CA; it ends with an offline HSM-backed root, separate corporate and device issuing CAs enrolling by ACME and EST, an expiry check that triggers automatic renewal, every certificate inventoried, OCSP back on and an agility plan beyond RSA-2048.

CY-SENIOR-079Senior Level · Enterprise PKI Program

Enterprise PKI & Certificate Lifecycle Program — The PKI Staircase

A senior-level program course that builds and runs an enterprise public-key infrastructure as a whole system. Climb the PKI staircase - eight steps: Trust Architecture, CA Hierarchy & Ceremony, Certificate Policy & CPS, Enrollment & Automation, Inventory & Discovery, Renewal & Revocation, Use-Case Integration, and Governance & Agility - at a global manufacturer and IoT-device maker recovering from an expired-certificate outage, with real openssl, ACME, SCEP/EST, certificate-inventory, and OCSP/CRL work throughout. Four hands-on activities in every lesson.

16 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Design a trust architecture separating internal, public, and device/product PKI with deliberate, documented boundaries.
Stand up an offline root and HSM-backed issuing CAs through scripted, witnessed key ceremonies, hardened and backed up.
Write and audit a CP/CPS defining assurance levels, naming, validity, and minimum key sizes and algorithms.
Automate enrollment for servers, devices, users, and pipelines via ACME, SCEP/EST, and templated autoenrollment.

Price:৳10,000