Automated X.509 certificate management system : An Implementation Study
Tolvanen, Samuli (2026)
2026
Tietotekniikan DI-ohjelma - Master's Programme in Information Technology
Informaatioteknologian ja viestinnän tiedekunta - Faculty of Information Technology and Communication Sciences
This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Hyväksymispäivämäärä
2026-09-18
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:tuni-202609179846
https://urn.fi/URN:NBN:fi:tuni-202609179846
Tiivistelmä
Digital certificates are part of modern IT and OT information systems. Their role is critical in securing digitalized societies by providing encryption and digitally verified identities. As the number of certificates increases and their validity periods become shorter, automating X.509 certificate management has grown in importance.
Automating certificate management for an organization’s private PKI follows similar structures to those used in public PKIs. However, private PKI solutions introduce additional requirements related to trust distribution of the private CA, restricted networking, and secure storage of keys. Offline and private implementations of the ACME protocol can extend certificate automation to more limited contexts, such as OT environments.
This thesis takes a deep dive into certificate automation by implementing an automated certificate management system based on the ACME protocol. The implementation enables the study and comparison of different technologies available on the market. It covers certificate issuance, renewal, revocation, validation, and integration with a preexisting organizational certificate authority hierarchy.
Part of the research involved implementing a fully automated infrastructure-as-code (IaC) simulation of a real PKI. It was used as a development environment for the future production solution to test and verify the functionalities of the selected ACME server. This extended validation method enabled testing different configurations and protocols before production deployment.
The solution under development can be considered a critical system. This means that it needed to fulfill tight security specifications. PKI solutions are digital identity and trust-requiring applications. The keys required for certificate signing are stored on hardware security modules, operating systems are hardened, and the development has gone through threat modeling according to the security requirements.
The implementation fulfilled the major predefined requirements and demonstrated that ACME-based automation can be successfully integrated into a private PKI. The thesis also outlines prospects for automated PKI, including short-term operational and security risks, as well as the long-term threat posed by developments in quantum computing.
Automating certificate management for an organization’s private PKI follows similar structures to those used in public PKIs. However, private PKI solutions introduce additional requirements related to trust distribution of the private CA, restricted networking, and secure storage of keys. Offline and private implementations of the ACME protocol can extend certificate automation to more limited contexts, such as OT environments.
This thesis takes a deep dive into certificate automation by implementing an automated certificate management system based on the ACME protocol. The implementation enables the study and comparison of different technologies available on the market. It covers certificate issuance, renewal, revocation, validation, and integration with a preexisting organizational certificate authority hierarchy.
Part of the research involved implementing a fully automated infrastructure-as-code (IaC) simulation of a real PKI. It was used as a development environment for the future production solution to test and verify the functionalities of the selected ACME server. This extended validation method enabled testing different configurations and protocols before production deployment.
The solution under development can be considered a critical system. This means that it needed to fulfill tight security specifications. PKI solutions are digital identity and trust-requiring applications. The keys required for certificate signing are stored on hardware security modules, operating systems are hardened, and the development has gone through threat modeling according to the security requirements.
The implementation fulfilled the major predefined requirements and demonstrated that ACME-based automation can be successfully integrated into a private PKI. The thesis also outlines prospects for automated PKI, including short-term operational and security risks, as well as the long-term threat posed by developments in quantum computing.