Getting Started
This page is the shortest path from contract signature to the first production certificate. Each step links to the detailed page. The exact schedule is agreed with EC during planning.
Onboarding path
- Kick-off. EC and the customer name the executive sponsor and technical contacts, and agree change windows. See Prerequisites.
- Client Intake Form. The customer completes the form with its PKI, security, networking, Active Directory and application owners. EC reviews it and runs working sessions to close open items.
- Design sign-off. The CA hierarchy, CA names, algorithms, validity periods, revocation settings and certificate profiles are approved. See Architecture and Components.
- Network and DNS. The customer creates the CNAME for the CDP and AIA host name and opens the required firewall rules. See Network Endpoints and Allow-listing.
- Key ceremonies and CA build. EC generates the CA keys in the HSM and builds the Root CA and Issuing CA(s). See Build the Root CA and Build the Issuing CA.
- Trust distribution. The customer adds the EC Root CA and Issuing CA certificates to its trust stores. See Add CA Certificates to the Client Trust Store.
- Portal access. EC creates the first Admin account; the customer adds departments, users and roles, and optionally configures Single Sign-On. See User Onboarding.
- Enrollment channels. The customer deploys the Enrollment Gateway for Windows auto-enrollment and any other integrations in scope (NDES, Intune, Jamf, ACME, API). See Gateway Deployment and Integrations.
- Pilot. Issue, renew and revoke test certificates for each enrollment method, and check chain building and revocation from representative clients.
- Production. After customer sign-off, production workloads start requesting certificates. Existing PKIs are migrated in waves; see Migration Overview.
First certificate
The quickest way to confirm that the service works end to end is a manual CSR enrollment:
- Sign in to the portal and open Enrollment.
- Select CSR Enrollment, choose the Issuing CA and template, and paste or upload a CSR.
- Submit the request. If the template requires approval, an approver accepts it.
- Download the certificate with its chain and install it.
- Confirm that the certificate appears in the Inventory.
See Certificate Enrollment for every enrollment option.