Business Continuity and Disaster Recovery
Certificate validation and issuance are critical to authentication, VPN, Wi-Fi and TLS. This page describes how PKI-as-a-Service is protected against failures and how it is recovered.
Resilience by design
- Revocation data: CRLs and CA certificates are served from geo-redundant Azure Blob Storage, so validation continues during a regional outage and even while a CA is being recovered.
- Root CA: kept offline and used only for planned tasks; its key is backed up in protected HSM form.
- Issuing CA: the CA database and configuration are backed up regularly, and the key material is backed up in protected HSM form, so the CA can be rebuilt without exposing the key.
- HSM: a protected HSM backup is stored in a separate secure location under M-of-N custody.
- Customer side: if the Enrollment Gateway is unavailable, Windows retries enrollment and renewal; existing certificates keep working.
Recovery objectives
| Item | Target |
|---|---|
| Recovery Time Objective (RTO), Issuing CA | Defined in the subscription agreement |
| Recovery Point Objective (RPO), Issuing CA database | Defined in the subscription agreement |
| RTO, Self-Service Portal | Defined in the subscription agreement |
| Backup frequency (CA database, portal) | Regular backups, as defined in the subscription agreement |
| Backup retention | Defined in the subscription agreement |
| DR test frequency | Tested regularly |
Customer recommendations
- Deploy at least two CEP / Enrollment Gateway servers behind a load balancer where auto-enrollment is business critical. Multiple Enrollment Gateway servers behind a load balancer are supported.
- Renew certificates well before expiry (for example 6 weeks for one-year certificates) so that a short outage never causes an expiry.
- Keep a copy of the EC Root CA and Issuing CA certificates and the CPS with the customer's own recovery documentation.
- Include PKI-as-a-Service in the customer's own business continuity tests.
Security incidents are handled under Incident Response.