FAQ
Where are the CA private keys kept? In a Hardware Security Module, a dedicated hardware device in the EC datacenter. The keys never leave it in plain form, and the customer does not need to manage their security.
Does the customer need to run any servers? Only for Windows auto-enrollment (the CEP server and the Enrollment Gateway) and, where used, NDES. The CAs themselves are run by EC.
Why is the CRL published over HTTP and not HTTPS? Checking a CRL over HTTPS would require checking the certificate of the web server first, which can create a loop. CRLs are signed by the CA, so they cannot be changed without detection even over HTTP.
Why is LDAP not used for CDP and AIA? The CAs are in the EC network, not in the customer's Active Directory, so LDAP locations would not be reachable by clients. HTTP locations work for every client.
Can existing certificates from the old PKI still be used during migration? Yes. Both hierarchies run side by side; old certificates stay valid until they expire or are replaced. See Migrating to PKI-as-a-Service.
What happens if the Enrollment Gateway is down? New auto-enrollment and renewal requests wait and are retried by Windows. Existing certificates keep working.
Is post-quantum cryptography supported? The hierarchy is crypto-agile, and a migration path is described in PQC Standards.
Security, hosting and operations questions are answered in Security and Operations FAQ.