I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?

  • Hi, welcome to the community. Depends on whether the PKI cloud service allows you to retrieve all necessary data. That's vendor dependent and cannot be answered here, I'm afraid.
    – user284677
    Aug 22, 2023 at 8:06
  • what do you mean with "PKI stuff", what do you mean by "move" (is it transporting the secret, or just switch over to using your own) and what do you think you need to manage it yourself?
    – LvB
    Aug 22, 2023 at 9:37
  • I’m voting to close this question because it depends on your provider. You need to ask this of them.
    – schroeder
    Aug 22, 2023 at 12:49

1 Answer 1


The correct answer would be - ask the provider.

Many PKIaaS offerings share the root CA between customers. In those cases, they will never pass the root CA private key to you as you'd then be in control of all their customer's PKI - not the best business model!

For a fully managed private PKIaaS, where they host your root CA for you, I would be asking myself whether I would want to be involved with a provider which claims they're secure, but at the same time is willing to pass over private keys. Once they've passed the keys to you, there will potentially be two copies - yours, and theirs. It would be very difficult to verify that they've completely destroyed any and all backups of key and any activation data/tokens.

Some PKIaaS providers may offer an option where you host your own offline root CA on-prem, which then signs the issuing CA certificate of their PKIaaS offering. With this setup, you can revoke the PKIaaS certificate once you've migrated from PKIaaS to on-prem later. The downside of this is that you have to manage your own root CA, which if done properly, involves a substantial amount of effort. If you can do that, then why bother with PKIaaS in the 1st place? At this point, it most likely boils down to cost. Is it more cost effective to outsource the issuing CA to a PKIaaS provider; or to buy/rent infrastructure, CA software, certificate life-cycle management software, then train your staff, develop the governance and processes required to operate a PKI service, carry out audits etc. yourself? Bear in mind that much of that will need to be done for your on-prem root CA, so the addition of an issuing CA (or two) may not be that much of an overhead. Only your organisation can work this out.

Not the answer you're looking for? Browse other questions tagged .