Termination and Exit
Ownership of the PKI stays with the customer. This page explains what happens to the CA hierarchy, keys, certificates and records when a subscription ends, so that the customer can plan an orderly exit with no loss of trust.
Before the end of the subscription
- The customer informs EC of its intention not to renew (notice period as defined in the subscription agreement).
- EC and the customer agree an exit plan: the target PKI, the migration schedule, and the handling of keys and records.
- Certificates are moved to the new PKI in waves, using the same approach as Migrating to PKI-as-a-Service in reverse.
CA keys
The CA private keys are held in EC's HSMs and never leave them in plain form. At exit, the customer chooses one of the options agreed in its contract:
| Option | What happens |
|---|---|
| Transfer | Transfer options for the CA keys are agreed with EC as part of the exit plan. |
| Retire and destroy | The CAs stop issuing, a final CRL is published, and the keys are destroyed in the HSM. The destruction is recorded and the record is provided to the customer. |
Data returned to the customer
- Certificate inventory and reports, exported from the portal (CSV or PDF).
- Portal activity logs, exported to CSV.
- CA certificates, final CRLs and the CPS.
- The CA database and CA audit logs, provided on request in a format and delivery method agreed in the exit plan.
Validation after exit
Relying parties still need CRLs and CA certificates for certificates that have not yet expired. EC keeps the CDP and AIA files available for the period agreed in the exit plan, or hands them over for the customer to host behind the same CNAME.
Tip: Because the CDP and AIA URLs use the customer's own host name (CNAME), the customer can move the files to its own web server without changing any issued certificate.
Deletion
After the agreed retention period, EC deletes customer data from the portal and backups and confirms the deletion in writing. The retention period is defined in the subscription agreement.