Sherlocked Security – PKI & Certificate Management

Secure Your Digital Identity with Robust, Scalable, and Policy-Compliant Certificate Infrastructure

1. Statement of Work (SOW)

Service Name: PKI & Certificate Management
Client Type: Enterprises, Governments, Critical Infrastructure, Regulated Industries
Service Model: Assessment, Design, Deployment, and Lifecycle Management
Compliance Alignment: NIST 800-57, ISO/IEC 27001, eIDAS, PCI-DSS, HIPAA, CMMC

Service Scope Includes:

Design, deployment, or modernization of Public Key Infrastructure (PKI)
Assessment of existing CA hierarchy, certificate issuance policies, and trust chains
Integration with identity platforms (e.g., AD CS, Azure AD, LDAP)
Automation of certificate issuance and renewal (DevOps, IoT, MDM)
Revocation strategy (CRL/OCSP) and secure key storage implementation
Certificate lifecycle and expiration risk management
Policy compliance, trust anchor validation, and documentation

2. Our Approach

[PKI Discovery] → [Trust Chain Validation] → [Risk & Policy Review] → [Automation Strategy] → [Redesign/Deployment] → [Monitoring Setup] → [Documentation & Training]

3. Methodology

PKI Discovery & Documentation
- Inventory of CAs (Root, Intermediate), cert types, issuance processes, and trust anchors
Certificate & Key Review
- Evaluate algorithms, key sizes, expiry periods, and revocation mechanisms
Policy & Compliance Assessment
- Assess CP/CPS (Certificate Policy/Certification Practice Statement) alignment with regulatory standards
Automation & Integration Strategy
- Enable auto-enrollment and renewal via platforms like AD CS, HashiCorp Vault, Certbot, or Venafi
Vulnerability & Misuse Detection
- Identify wildcard certs, weak crypto, shadow CA instances, or stale certificates
Revocation & Expiration Planning
- Establish OCSP/CRL reliability, certificate expiry monitoring, and alerting mechanisms
Secure Key Storage & HSM Integration
- Evaluate need for Hardware Security Modules (HSMs) or cloud-based KMS for private key protection

4. Deliverables to the Client

PKI Architecture Assessment Report
Certificate Risk & Inventory Report (issued, expired, weak, wildcard, unmanaged certs)
CP/CPS Compliance Gap Analysis
Certificate Lifecycle & Automation Plan
Recommendations for Revocation, Storage, and Expiry Monitoring
Executive Summary & Compliance Readiness Briefing

5. What We Need from You (Client Requirements)

Access to PKI Console / CA Servers (Root & Intermediate)
Certificate Inventory from key systems (servers, VPN, apps, IoT, DevOps, mobile)
Access to AD/LDAP Integration Schemas (if applicable)
PKI Policy Documentation (CP, CPS, and certificate usage guidelines)
Stakeholder Interviews (PKI administrators, infrastructure leads, app teams)

6. Tools & Technology Stack

PKI & Certificate Discovery:
- CertSpotter, Nessus, Venafi, X.509lint, Censys, SSLyze
Automation & Renewal:
- ACME/Certbot, HashiCorp Vault, Microsoft AD CS, Smallstep, cfssl
Key Management:
- AWS KMS, Azure Key Vault, Google Cloud KMS, Thales Luna HSM
Revocation & Expiry Monitoring:
- OCSP Responder Checks, CRL Analysis, Nagios Plugins, Zabbix, Nagios, Keyfactor

7. Engagement Lifecycle

Kickoff & Scope Definition
PKI & Certificate Discovery
Architecture & Policy Review
Certificate Risk Identification
Automation & Key Management Strategy
Monitoring & Revocation Planning
Remediation & Deployment Support
Reporting & Training

8. Why Sherlocked Security?

Feature	Sherlocked Advantage
End-to-End PKI Support	From root CA architecture to automation and lifecycle management
Security & Compliance Focused	PKI alignment with PCI, HIPAA, NIST, and industry best practices
Crypto Hygiene Analysis	Evaluate cert strength, revocation gaps, and insecure usage
Certificate Automation Expertise	Integration with DevOps, MDM, and cloud platforms
Operational Visibility	Continuous expiry tracking and alerting to avoid outages or breaches

9. Real-World Case Studies

Expired Cert Outage in SaaS Platform

Client: A mid-sized SaaS provider
Issue: Production downtime caused by expired backend service certs
Action: Deployed automated Certbot and integrated with Slack for expiry alerts
Result: Eliminated manual cert tracking and reduced renewal risk to near-zero

PKI Risk Audit for a Healthcare Organization

Client: Regional hospital network
Issue: Weak key lengths and unmanaged certs in clinical and IoT environments
Action: Designed centralized cert issuance with AD CS and IoT device enrollment
Result: Improved compliance with HIPAA and increased cert visibility by 300%

10. SOP – Standard Operating Procedure

Inventory All Issued Certificates
Analyze CA Hierarchy & Trust Models
Audit Certificate Usage & Expiry Timeline
Validate CRL/OCSP Mechanisms & Revocation Paths
Assess CP/CPS Against Compliance Frameworks
Implement Automation & Monitoring Tools
Document Findings & Recommendations
Assist in Key Storage or HSM Rollout (if applicable)

11. Readiness Checklist

1. Pre-Engagement

[ ] Documentation of CA hierarchy
[ ] CP/CPS documents
[ ] List of cert-enabled systems (VPN, portals, internal apps, IoT)
[ ] Known expiry timelines and cert contacts
[ ] Access to PKI/CA management consoles

2. During Engagement

[ ] Run certificate discovery and analysis
[ ] Identify high-risk certs (wildcard, self-signed, SHA1, expired)
[ ] Review OCSP/CRL configurations
[ ] Map trust chain for each cert group
[ ] Interview PKI admins and application teams

3. Post-Engagement

[ ] Deliver risk report and remediation roadmap
[ ] Implement monitoring tools and alert thresholds
[ ] Establish automation pipelines where applicable
[ ] Provide governance and lifecycle policy templates
[ ] Conduct knowledge transfer and training session

PKI & Certificate Management