PKI High-End Consulting
PKI High-End
Consulting
Hardening · Post-Quantum
Why a PKI is never a side project
A PKI goes unnoticed – until it fails. Then no user can log on with a smart card, the Wi-Fi rejects every device, web servers throw warnings and software deployment grinds to a halt. Even more dangerous than an outage is silent compromise: misconfigured certificate templates are today one of the most common paths from an ordinary user account to domain admin – known as ESC1 to ESC16 and found in almost every environment built before 2021.
Andy Wendel has worked with public key infrastructures since the first Windows Server certification authorities. He has designed PKIs for insurers, industry and public-sector clients, developed his own PKI training series and the Masterclass PKI with which he trains administrators across Germany, and was trained by Paula Januszkiewicz (CQURE) and Sami Laiho – two of the world’s leading experts in Windows and identity security. Anyone who teaches PKI must have understood it. Anyone who has also been building it for more than 20 years knows the mistakes that are in no manual.
The right choice: Andy Wendel
More than 20 years of hands-on PKI. From the first Windows Server certification authorities to post-quantum migration paths – the entire evolution first-hand.
Trainer of trainers. Author of his own PKI training series and the Masterclass PKI; Microsoft Certified Trainer and one of 56 Microsoft Certified Learning Consultants worldwide.
Trained by the best. Trained by Paula Januszkiewicz (CQURE) and Sami Laiho.
PKI and AD from a single source. Certificate infrastructure is Tier 0. Someone who masters both does not build a PKI that endangers Active Directory – or vice versa.
Enterprise experience. PKI projects in [insurance, industry, public sector, higher education] – references on request.
Cleared for confidential work. Specialised in VS-NfD environments; secure collaboration via DRACOON.
Vendor-independent. No commission on HSMs, certificates or lifecycle tools. Recommendations are based solely on your environment.
Personal. You talk to the person who plans and delivers – no sales team, no handover to a junior crew.
„You build a PKI right once – or three times.“
PKI design and greenfield build
The decisions made when building a PKI – hierarchy, key lengths, algorithms, validity periods, protection of the root keys – last ten to twenty years. A mistake in the root CA cannot be patched, only fixed by a rebuild. That is why the design should come from someone who knows the consequences from hundreds of environments.
Design principles
Two- or three-tier hierarchy: Offline root CA, issuing CAs, policy CAs where needed – as lean as possible, as separated as necessary.
Key protection: Hardware security modules (HSM) for root and issuing CAs where compliance or classification demands it; clear ceremonies for key generation and renewal.
Future-proof cryptography: SHA-256 and Key Storage Providers as the minimum, ECC where sensible, crypto-agility as a design goal – and a migration path to post-quantum algorithms (ML-KEM, ML-DSA per FIPS 203/204/205) before it becomes mandatory.
Tier 0 integration: Certification authorities are Tier 0 systems. Administration paths, permissions and templates are designed according to the Enterprise Access Model – not sealed off afterwards.
Operability: Template concept, naming conventions, CRL and OCSP design, expiry notifications, backup and recovery procedures your team can handle without outside help.
Leistungsumfang
- Requirements workshop: Which use cases does the PKI need to serve today, which in five years?
- Architecture document including Certificate Policy and Certification Practice Statement (CP/CPS) – audit-ready on request.
- Build of the environment with hardened CA servers, HSM integration, templates, auto-enrolment, CRL/OCSP distribution and monitoring.
- Root key ceremony with protocol and witnesses where required.#
- Handover with operations manual and enablement – as an individual training course for your team on request.
PKI migration and renewal
Many PKIs date from the Windows Server 2008 or 2012 era: SHA-1, 1024-bit keys, Cryptographic Service Providers instead of KSPs, a root CA that has been “temporarily” online as an enterprise CA for a decade. Such environments cannot simply be upgraded – they have to be replaced in a controlled way, without a single certificate becoming invalid in the process.
Typical scenarios
CA migration to current Windows Server versions: Transfer of database, keys and templates to Windows Server 2022/2025 while preserving the chain of trust.
SHA-1 to SHA-256 and CSP to KSP migration: Switching algorithms and providers with a coexistence phase so that legacy systems keep running and new systems use modern cryptography.
Root and issuing CA renewal: Renewal with or without a new key pair, distribution of the new trust anchors, clean retirement of the old chain.
Hierarchy rebuild with parallel operation: New PKI alongside the old one, step-by-step migration of all use cases, controlled decommissioning.
PKI as part of AD migration or cloud exit: Certificate infrastructure as part of a forest migration, merger or repatriation from the cloud – aligned with the AD design.
Rebuild after compromise: When a CA can no longer be trusted, a rebuild with full reissuance of all certificates is the only reliable path. We plan it so that operations continue.
PKI security review and hardening
Most PKIs were built before it was known how easily certificate templates can be abused. A review uncovers what attackers would find first: templates with a freely selectable subject name (ESC1), dangerous extended key usages (ESC2), enrolment agent abuse (ESC3), overly generous permissions on templates and CA (ESC4/ESC7), NTLM relay against web enrolment (ESC8), missing certificate binding (Certifried), outdated algorithms, online root CAs and unprotected keys.
Tools and approach
PingCastle und Locksmith:Standardisierte Prüfung der AD-CS-Konfiguration mit den Werkzeugen, die auch Angreifer und Auditoren einsetzen – Andy Wendel nutzt PingCastle in jedem Projekt und hat dessen Weiterentwicklung als Ideengeber begleitet.
Manual deep-dive: Templates, CA permissions, key protection, revocation infrastructure, availability, backup and recoverability – what no scanner sees.
Prioritised list of measures: Ordered by real attack path in your environment, not by score. Implementation on request.
Evidence: A report that holds up in front of financial auditors, ISO 27001 auditors, NIS 2 or DORA assessors and cyber insurers.
Zertifikats-Lifecycle und Automatisierung
Ein abgelaufenes Zertifikat auf dem falschen System ist bis heute einer der häufigsten Gründe für ungeplante Ausfälle. Die Lösung ist nicht ein besserer Kalender, sondern Automatisierung: Auto-Enrollment über Gruppenrichtlinien für Domänenmitglieder, NDES/SCEP und Intune für mobile Geräte und Nicht-Windows-Systeme, ACME für Webserver, Certificate Connector für Entra ID und Cloud-Dienste. Wir entwerfen den Lifecycle so, dass Ausstellung, Erneuerung und Sperrung ohne manuelle Eingriffe funktionieren – und dass Sie trotzdem jederzeit wissen, welches Zertifikat wo läuft.
Certificate lifecycle and automation
An expired certificate on the wrong system is still one of the most common causes of unplanned outages. The answer is not a better calendar but automation: auto-enrolment via Group Policy for domain members, NDES/SCEP and Intune for mobile devices and non-Windows systems, ACME for web servers, certificate connectors for Entra ID and cloud services. We design the lifecycle so that issuance, renewal and revocation work without manual intervention – and so that you still know at any time which certificate is running where.
Use cases we deliver
Strong authentication: Smart card logon, virtual smart cards, Windows Hello for Business with certificates, certificate-based authentication for Entra ID – phishing-resistant and passwordless.
Network access: 802.1X for LAN and Wi-Fi with computer and user certificates, VPN authentication, Always On VPN.
Encryption and signing: S/MIME, EFS, BitLocker recovery with key archival, document and code signing with HSM-protected keys.
Infrastructure: TLS for internal web services, LDAPS, RDP, domain controllers, Hyper-V live migration, SQL Server, SCCM/ConfigMgr – all from a template, not from self-signed certificates.
Key archival and recovery: So that encrypted data remains readable even after the employee has left the company.
How we work
1 · Assessment. Inventory of the existing PKI, all certificate consumers and their dependencies – technical and organisational.
2 · Design. Architecture document and CP/CPS that justify decisions. Understandable for decision-makers, actionable for administrators.
3 · Proof. Build in a test environment; rehearse renewal, revocation, recovery and failure – before the production root CA exists.
4 · Execution. Build or migration in clearly delimited steps, with a coexistence phase and defined acceptance criteria.
5 · Handover and enablement. Operations manual, emergency procedures and knowledge transfer – as a Masterclass PKI for your team on request. The goal is independence.
At eye level, with respect for what your team has already built – and with the clarity you are entitled to expect from an external expert.
Let’s talk about your PKI.
In a no-obligation 30-minute discovery call we clarify where your certificate infrastructure stands, which risks are pressing and which options exist. No sales presentation – a technical conversation.
This post is also available in:
