Phase 5: PKIaaS Gateway Deployment
This phase connects the customer's enrollment environment to the EC-hosted PKIaaS platform. The components deployed depend on the selected enrollment methods; the Windows auto-enrollment design may require a customer-side CEP service and PKIaaS Enrollment Gateway.
Key activities
- Install the EC Enrollment Gateway on the customer-provided server or servers that meet the approved requirements. Configure its service identity, certificates, endpoint addresses, and connection to EC-hosted services.
- Where Windows auto-enrollment is in scope, configure CEP, the required service accounts, SPNs, delegation settings, and enrollment policy. Apply only the settings required by the approved authentication design.
- Import or publish the approved templates and enrollment service information needed by the customer's Windows clients. Set template permissions so only the intended users or computers can enroll.
- Configure Group Policy for the pilot users and computers. Confirm that clients can discover the enrollment policy, see the intended templates, submit a request, and receive the issued certificate.
- Configure additional integrations, such as NDES/SCEP, ACME, Intune, or APIs, where they are included in the customer scope. Test each integration separately before enabling it for a larger population.
- Configure portal access, roles, dashboards, notifications, and certificate inventory views for the customer's authorized PKI team.
Phase outcome
At the end of this phase, the customer's users, computers and systems have a working route to request certificates from PKIaaS. The Enrollment Gateway and, where required, CEP are installed and connected to the EC-hosted Issuing CA, with the correct service accounts, SPNs, delegation settings and templates. Group Policy delivers the enrollment policy to the pilot users and computers, and each additional integration in scope, such as NDES/SCEP, ACME, Intune or the API, has been tested on its own. The customer's PKI team can sign in to the portal with the agreed roles and view the certificate inventory and dashboards. Because every channel has passed pilot testing, certificate migration can begin with confidence.
The detailed procedure is in Gateway Deployment.