From root trust to everyday operations.

The root anchors the hierarchy. Its private key and signing process deserve explicit custody and recovery controls.

• Define certificate policy and responsibilities.
• Protect root key operations and record the ceremony.
• Distribute trust through an approved channel.

An issuing authority signs end-entity certificates under a constrained policy, keeping routine issuance separate from root operations.

• Constrain issuance to intended identities and uses.
• Define enrolment authentication and approval.
• Monitor issuance and administrative changes.

Service owners request, deploy and renew certificates. Automation still needs clear ownership and failure handling.

• Map each certificate to an accountable service owner.
• Test renewal and deployment behaviour.
• Agree expiry alerts and recovery steps.

A relying party checks the chain, identity and applicable policy before accepting a certificate for its intended use.

• Check the chain against the intended trust anchor.
• Validate identity, validity period and allowed uses.
• Apply the system’s revocation requirements.

The hierarchy must remain understandable when a service fails, a key is replaced or trust needs to change.

• Maintain operational and incident runbooks.
• Test restore and key replacement processes.
• Review evidence and retire unused trust.