Migration Overview
Migration to PKI-as-a-Service (PKIaaS) is carried out in controlled phases so the customer can move certificate use cases to the EC-hosted PKI without interrupting applications or authentication services. The existing and new hierarchies operate in parallel during migration. Each certificate category is assessed, migrated, and validated before its old enrollment path is retired.
The phases described below cover preparation, HSM and CA provisioning, customer trust, enrollment integration, certificate replacement, cutover, and decommissioning. The detailed schedule, configuration values, and responsibilities are agreed with the customer during planning.
Migration phases
- Phase 1: Pre-migration Preparation: establish what the existing PKI supports and what the new PKIaaS environment must provide, and agree the migration plan.
- Phase 2: HSM Provisioning: provision the HSM resources and generate the Root and Issuing CA keys in documented key ceremonies.
- Phase 3: Root CA Trust Setup: build the offline Root CA, publish its certificate and CRL, and distribute it to the customer trust stores.
- Phase 4: Issuing CAs Provisioning: build and sign the online Issuing CAs, publish their certificates and CRLs, and configure the approved templates.
- Phase 5: PKIaaS Gateway Deployment: connect the customer enrollment environment to PKIaaS and pilot each enrollment method.
- Phase 6: Certificate Migration: replace certificates in planned waves and validate each group at application level.
- Phase 7: Validation and Cutover: validate end to end and make PKIaaS the standard enrollment path.
- Phase 8: Old CA Decommissioning: stop issuance from the old CA and retire it while its validation information stays available.
A rollback procedure is defined for every wave before production changes begin; see Rollback Plan.