Knowledge Base
Observations interesting enough for a human to spend sufficent enough time contemplating and writing about to publish on this platform.
Hsm Ped Keys Xfer
Coworker asks “are the PED keys in possession?”
Context: A Hardware Security Module (HSM) is end-of-life (EOL). Customer wants to understand risk and action items if moving the associated private keys to a new HSM still within their PKISaaS certificate lifecycle management (CLM) solution.
Expert analysis: HSMs may have a physical security mechanism so a single entity could not access the device. For example, CUSTOMER, has PED keys and vendor (E.g., DigiCert) have PED keys, CUSTOMER has to come on site to unlock their HSMs - so, that’s a scheduled event. Customer may retain the right to limit [vendor] access using PED keys.
Concepts - industry standards, governing bodies, design ideas, use cases, specific here
[0002] Observations from the field - where mostly likely that observation originated from a very different use case and implementation that may not be relevant.
This simple knowledge base is (over?) engineered using enteprise grade solutions and its, very small but continuous improvement will be made and a few may be documented, under the tag format this.dnspki
Meaning the specific implementation of an item/concept as it was done on this Hugo-based website will use this tag.
0001 Acronyms, Items, Definitions, Examples, Concepts, Illustrations
Introductory article on the nomenclature within this website.
OBJECT:
Acronym: industry initial letters or parts of a series of words
Item: name, person, place, thing of the industry specific item
Definition: explanation or history of the acronym or noun
Example: current or history examples of the acronym of noun
Illustration: a visual representation of the acronym or noun
Notes: comments input by a contributor
IMPLEMENTATION:
Acronym: CA
Item: Certificate Authority
Definition: trusted organization that verifies identities and issues digital certificates [1]
Example: Public: Let’sEncrypt, DigiCert, Sectigo, GlobalSign, cloud providers
Example: Private: Microsoft Active Directory Certificate Services (ADCS), EJBCA Open-source PKI software
Notes: Many say “internal” when PKI people may tend to use “private”