Certificate Management Security Standard

1. Scope and Alignment

This standard applies to systems, applications, platforms, devices, and services that issue, consume, store, or rely on digital certificates. It supports secure design principles including threat modelling, defence in depth, least privilege, secure defaults, and auditable lifecycle control.

2. Discovery and Inventory

The organisation must maintain automated certificate discovery across internal, external, cloud, and hybrid environments. Discovery should cover public-facing TLS, internal TLS, load balancers, gateways, service meshes, cloud certificate services, endpoint/device authentication, code signing, and S/MIME where in scope.

3. Trust Architecture

• Separate internal and external trust zones.
• Use approved public CAs for public-facing certificates.
• Use approved internal PKI or managed private CA services for internal certificates.
• Protect root CA keys using offline or hardware-backed controls appropriate to criticality.
• Use subordinate CAs to separate issuance by environment, use case, or assurance level.
• Document trust chains and certificate boundaries for critical services.

4. Cryptographic Requirements

5. Issuance, Renewal, and Revocation

Certificate issuance must follow approved workflows. SAN entries must be validated against approved domains, services, or inventory records. High-risk certificate types, including wildcard, code signing, and privileged service certificates, should require recorded approval.

Standard certificates must be renewed at least 30 days before expiry. Confirmed key compromise should trigger revocation within one hour where technically possible. OCSP and CRL services must be monitored for availability and correctness.

6. Private Key Protection

• Root CA keys must use offline HSM or equivalent high-assurance protection.
• Subordinate CA keys must use HSM or managed key protection.
• High-value service keys should use HSM, TPM, cloud HSM, key vault, or equivalent controls.
• Private keys must not be shared through email, chat, file shares, or unapproved repositories.
• Exportable private keys must be disabled unless explicitly required and approved.

7. Monitoring and Assurance

Monitoring must identify certificates expiring within 90, 60, and 30 days; expired certificates; unknown certificates; weak algorithms; invalid chains; unexpected issuing CAs; CT log matches; and OCSP or CRL failures.

Assurance activities should include quarterly inventory reviews for critical services, quarterly TLS configuration reviews for public-facing services, annual certificate profile review, annual trust architecture review, and incident review after certificate-related events.

8. Metrics

9. Governance

Exceptions must be documented, risk assessed, approved, time-bound, and reviewed before expiry. This standard should be reviewed annually or after significant cryptographic standard updates.