Skip to content
CoreEncryption
Incident
Book a PKI health check Get incident support

Hardware key custody

The key stays inside the boundary.

We help you choose the right HSM model, integrate it with ADCS, run a ceremony your auditors can follow and leave your operators ready to recover it.

Discuss your HSM project

Custody model

Signing crosses the boundary.
The private key does not.

Hardware protection matters because a stolen CA server should not automatically become a stolen CA identity. The design around the device — quorum, backup and recovery — is what makes that promise operational.

Key custody inside a hardware security module An issuing certificate authority generates its private key inside a hardware security module partition. Signing requests cross the boundary inward and signatures cross back out, but the private key never leaves the hardware. ISSUING CA CERTIFICATE SERVICES PRIVATE KEY HSM PARTITION — FIPS VALIDATED CA private key NON-EXPORTABLE · QUORUM 2 OF 3 KEY NEVER LEAVES THIS BOUNDARY ↓ IN SIGN REQUEST ↑ OUT SIGNATURE ONLY STOLEN SERVER = NO STOLEN KEY
Key custody boundary The HSM is not a magic appliance. It is an enforceable boundary inside a documented operating model.

Selection criteria

Choose for the operating model — not the brochure.

01

Workload

Signing rate, key count, latency tolerance and the applications that must integrate.

02

Custody

Role separation, M-of-N quorum, operator geography and emergency access.

03

Resilience

High availability, backup model, recovery site and the failure modes the service must survive.

04

Platform

Network appliance or cloud service, supported CSP/KSP, firmware lifecycle and audit requirements.

Scripted ceremony

Nothing important is improvised in the room.

  • Pre-approved commands and expected output
  • Named roles and M-of-N quorum
  • Witnessed evidence without exposed secrets
  • Tested backup and recovery
  • Signed operational handover
  1. 01

    Approve the script

    Commands, expected outputs, roles, rollback conditions and evidence are reviewed before the window.

  2. 02

    Establish custody

    Named participants authenticate, activate the required quorum and confirm device and partition identity.

  3. 03

    Generate or import

    The CA key is created inside hardware or migrated through a controlled, documented path.

  4. 04

    Verify and recover

    Signing, backup and restore paths are tested before the ceremony is closed.

  5. 05

    Sign the record

    Fingerprints, policy state, custody assignments and exceptions become the auditable handover.

Integration and migration

Move the key without breaking trust.

We map the current provider, CA service behaviour, certificate chain and recovery path before any migration. Cutover gates prove that the CA can sign, publish and recover while existing certificates continue to validate.

Familiarity, not partnership

Engagements can cover network HSMs and cloud HSM services that expose supported Microsoft CSP/KSP integrations. Specific vendor and model fit is validated during discovery.

No manufacturer partnership or endorsement is implied. Recommendations remain vendor-neutral.

Plan an HSM engagement