Shared Responsibility Model
PKI-as-a-Service splits responsibilities between EC and the customer. The sections below list the components each party runs and who is responsible for each deployment and operating task.
EC-managed components
- EC Root CA: EC-managed environment, offline. Role: Trust anchor of the hierarchy. Signs only the Issuing CA certificate and the Root CRL.
- EC Issuing CA: EC-managed Azure environment. Role: Issues all end-entity certificates.
- Hardware Security Modules: EC datacenter. Role: Physical devices that generate, store and use the CA private keys. See EC Datacenter HSM.
- CDP and AIA storage: Azure Blob Storage, globally redundant. Role: Hosts the CRLs and CA certificates referenced in every certificate.
- Self-service portal: EC-managed environment. Role: Web portal for onboarding, enrollment and CA health monitoring.
Customer-side components
- DNS: Creates the CNAME record that maps the customer host name to the CDP and AIA storage, and the records for the CEP server and the Enrollment Gateway.
- Active Directory and Group Policy: Provides Kerberos authentication for enrollment and distributes trust, the CEP settings and the auto-enrollment policy to domain computers.
- Trust stores: Hold the EC Root CA and Issuing CA certificates, so certificates are trusted.
- Portal users: Authorised administrators, approvers and certificate owners.
- CEP server and Enrollment Gateway: Hosts provided, patched and operated by the customer where Windows auto-enrollment is in scope. See Gateway Deployment.
- NDES server: Optional. Required only for SCEP device enrollment. See Integrations.
Responsibility matrix
| Area | Customer | Encryption Consulting |
|---|---|---|
| Client Intake Form | Completes and returns | Reviews and confirms |
| Root CA and Issuing CA build and operation | — | Responsible |
| HSMs and CA private keys | — | Responsible |
| CDP and AIA publishing to Azure Blob Storage | — | Responsible |
| CNAME record for the CDP/AIA host name | Responsible | Provides the target endpoint |
| Adding EC CA certificates to trust stores | Responsible | Provides the certificates and assistance |
| Self-service portal availability | — | Responsible |
| Portal users, departments and approvals | Responsible | Initial Admin setup |
| Gateway servers, OS, patching, domain join | Provides the environment | Provides the prerequisites |
| Firewall rules and DNS for the gateway | Responsible | — |
| Service accounts, SPNs, delegation | Responsible | Specification and validation |
| Gateway ISO, scripts, template LDF files | — | Responsible |
| NTAuth publication, template import, Group Policy | Access and approval | Execution (joint session) |
| Client validation | Joint | Joint |