Where can I find step by step instructions for a key signing ceremony? We will be doing one for our non-production environment and then one for our production environment (at a later date). I have found general write ups on ceremonies but I was hoping to find step by step instructions, prerequisites, checklists, etc.

Note: the keys we will be generating are not root level keys.

1 Answer 1


Normally a Key Signing Ceremony only makes sense for root level keys. For non root level keys, the way it happens should be described in the policy rules of the PKI.

The main points of attention are IMHO:

  • how do you guarantee that the private key has always been under the sole control of its recipient - it can be a problem where you use physical devices such as a smartcard
  • how do you guarantee that the person that recieved the signed certificate is actually who he claims to be (control of an ID card, who did the control, how and when, etc.)
  • how do you save the proofs of those 2 previous parts (mainly important for the second one)
  • 1
    Thanks for your response, Serge. Can you provide any key signing documentation for root level keys?
    – Hmmmmm
    Feb 23, 2017 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .