- Client
- London borough council
- Sector
- Local Government
- Services
- Certificate Services, Security Architecture
- Year
- 2022
- Timeline
- 3 months
- Read time
- 4 min read
1
Offline root authority as the single point of trust
2
Issuing authorities with CRL and OCSP revocation
3
Azure environments covered by the design
01 · The challenge
What we walked into
Certificates touched every service the borough ran, from device authentication to code signing, but the PKI that issued them had grown by accretion rather than design.
Expiring certificates were discovered when services failed, revocation was unreliable, and there was no single record of what had been issued or to whom.
The borough had a cloud-first vision, with production, pre-production, and sandbox Azure subscriptions already active, and the new infrastructure had to serve the cloud estate and on-premises services equally.
02 · Our approach
How we got there
- 01
Map the certificate estate
Every certificate, every issuing point, and every service dependency on both sides of the cloud boundary, so the design started from a full picture of what exists.
4 weeks
- 02
Design the hierarchy
An offline root certificate authority held as the single point of trust, with two new subordinate issuing authorities carrying CRL and OCSP roles for revocation.
4 weeks
- 03
Secure the authorities
Physical security and HSM protection for the root, an authorisation model for every administrative action, and reporting so the security team can audit successful and unsuccessful authorisation events.
3 weeks
- 04
Document the practice
A Certificate Practice Statement covering issuance policy, key lifetimes, and revocation procedures, so the council runs the service from a document rather than from memory.
2 weeks
03 · The outcome
What changed
The borough now operates a designed PKI with one offline root, two issuing authorities with working revocation, and a documented practice statement. Certificates are issued, tracked, and renewed as a managed service across the cloud and on-premises estate.
A single point of authority
One offline root of trust unifies PKI across the borough, ending the parallel certificate estates that had grown up separately.
Expiry managed, not discovered
Certificate lifetimes are tracked, so renewal happens ahead of the warning instead of after the outage.
Revocation that works
CRL and OCSP services on both issuing authorities, so a compromised certificate can be withdrawn in minutes rather than hoped away.
Audit-ready evidence
The security team can report on what has been issued, by whom, and whether authorisation attempts succeeded.
“Certificate expiry used to find us before we found it. Now there is one authority, one documented practice, and reports that tell us what is issued and what is running out. They left us with something we can run ourselves.”
Technologies
- Windows Server Certificate Services
- OCSP
- Certificate Revocation Lists
- HSM
- Azure
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.