Phase 7: Validation and Cutover
Cutover changes the customer's standard enrollment path to PKIaaS. It takes place only after every certificate category in the agreed cutover scope has passed its technical and business validation checks.
Key activities
- Confirm the health of the PKIaaS CAs, HSM connections, gateway, portal, CRL publication process, backups, monitoring, and customer-facing endpoints.
- Test chain building and revocation checking from representative customer networks and platforms. Verify that the Root and Issuing CA certificates are in the appropriate trust stores.
- Test each production enrollment method in scope, including manual requests, auto-enrollment, SCEP/NDES, ACME, Intune, or APIs. Confirm request approval, issuance, installation, renewal, and revocation.
- Review the migration tracker for failed or pending systems. Resolve blockers or document approved exceptions with an owner and a target date.
- Confirm through certificate inventory and CA issuance records that new production certificates are being issued by the PKIaaS CAs for the migrated use cases. Monitor application and authentication services during the agreed observation period.
- After customer approval, make PKIaaS the standard enrollment path for the migrated use cases. Retain the existing CA and its validation services while certificates issued by it remain in use.
Phase outcome
At the end of this phase, PKIaaS is the standard source of certificates for the use cases in scope. Every enrollment method has been tested end to end, from request and approval through issuance, installation, renewal and revocation, and chain building and revocation checks succeed from the customer's networks and platforms. The migration tracker shows no unresolved failures, and any remaining exceptions have an owner and a target date. The certificate inventory and the CA records confirm that new production certificates come from the PKIaaS CAs. The customer has approved the cutover, the environment is closely monitored during the agreed observation period, and the existing CA stays available for the certificates it issued earlier.