Certificates & PKI, IT Atlas

Overview

A public key infrastructure binds identities to key pairs through signed certificates. Internal PKI issues certificates for domain controllers, devices, Wi-Fi, VPN and applications; public CAs issue for internet facing services.

Internal certificate authorities are Tier 0 assets. A compromised issuing CA allows an attacker to mint trusted identities, which is why offline root CAs, template hygiene and enrolment auditing matter so much.

Security considerations

Keep the root CA offline; audit certificate templates for dangerous enrolment and subject supply settings.
Automate renewal and maintain a complete certificate inventory with owners.
Monitor CA issuance logs and enable strong certificate mapping enforcement.

Related topics

TLS

Transport Layer Security provides confidentiality, integrity and server authentication for application traffic, most visibly as HTTPS.

Active Directory

Microsoft's on premises directory service, providing authentication, authorisation, policy and object management for Windows environments.

Encryption

Protecting data confidentiality and integrity in transit, at rest and increasingly in use, with key management as the hard part.

Device Identity

Giving devices verifiable identities so access decisions can consider what the request came from, not just who made it.

Passwordless & Passkeys

Authentication using device bound cryptographic credentials or biometrics instead of a shared secret.

Wi-Fi

IEEE 802.11 wireless networking, providing shared medium access with its own authentication, RF design and roaming considerations.

Identity Architecture

The design of directories, identity providers, authentication flows, privilege tiers and lifecycle processes that govern all access.