What are the primary components of an enterprise PKI?

An enterprise PKI typically consists of a root CA and one or more subordinate, issuing CAs, a registration authority that verifies certificate requests before issuance, a certificate and key repository, and revocation services such as OCSP responders or certificate revocation lists. Supporting policies, including certificate policies and certification practice statements, define exactly how these technical components are permitted to operate.

Core building blocks:

• Root and subordinate CAs: The hierarchy of authorities that sign and issue certificates, with the root typically kept offline for maximum protection.
• Registration authority: The function that validates identity before a certificate request reaches the CA for signing.
• Certificate repository: The store of issued certificates and their associated metadata.
• Revocation infrastructure: OCSP and CRL services that let relying parties check whether a certificate is still trustworthy.
• Hardware security modules: Dedicated hardware that protects CA signing keys from extraction or misuse.

Cryptas Enterprise PKI, built on the primeID CERTIFY platform, brings these components together on a single, centrally managed platform capable of operating multiple CA hierarchies while keeping CA signing keys protected in hardware security modules throughout.