I am interested in learning about setting up an (internal) enterprise PKI the right way.

What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X.509 certificates. The CSP/Trust Center will consist of a CA, an RA, revocation services, and a directory service. We found software that appears to be suitable for running such a provider.

However, what's much less clear to me is how to architect and run the CSP in a highly secure and sutainable manner. For example,

  • What are the pros and cons of different hierarchies?
  • What needs to be considered when choosing the lifetime of certificates?
  • How do we separate the different parts of the CSP?
  • How does one store private keys securely?
  • ...

So I guess what I'm looking for are some sort of best practices for building and running an enterprise PKI. Where do people learn about them?

  • 3
    You should read through baseline requirements for certificate issuance. Not everything will apply but it will give you in idea of the scope of the work. The recommendation to setup a proper internal CA is probably: hire/consult someone who knows how to do this. This is entirely too big an undertaking to solve through a Q&A site.
    – Marc
    Commented May 21, 2020 at 12:56
  • @Marc: Thanks for the link, I'll have a look at it later. Regarding the scope of this undertaking: I agree that it's a big project and I certainly don't expect step-by-step instructions or something similar from this site. I'm only asking where to learn about this. Where does "someone who knows how to do this" learn how to do this?
    – eins6180
    Commented May 21, 2020 at 13:03
  • @eins6180 Give this a look: docs.microsoft.com/en-us/previous-versions/windows/it-pro/… As Marc mentioned, enterprise PKI is a massive topic
    – pm1391
    Commented May 22, 2020 at 17:23

1 Answer 1


You might find Part III "Deployment Considerations" in Understanding PKI by Adams & Lloyd valuable. In that part the authors address many of the deployment questions that should be considered for any large-scale PKI.

It's a bit older (the second edition is from 2003) but the book still contains great advice.

Not the answer you're looking for? Browse other questions tagged .