How does primeID Certify function as a Certificate Authority within an enterprise PKI?

primeID Certify operates as the Certificate Authority engine within an enterprise PKI, handling the core functions of issuing, signing, and managing certificates according to configured policies while protecting CA signing keys in hardware security modules.

Its role within a broader PKI:

• Policy-driven issuance: Certificates are issued according to templates and policies defined for each certificate type and tenant.
• Multi-hierarchy support: The platform can operate multiple PKI hierarchies from a single deployment.
• Hardware-protected signing: CA private keys are protected using HSMs rather than software-only key storage.
• Common Criteria-evaluated foundation: The platform's security architecture has undergone independent evaluation.

This gives organizations a consistent, centrally managed basis for establishing trust internally across their own users, devices, and services, distinct from relying on an external, publicly trusted root CA for internal use cases.