Many organizations see the benefits of going passwordless, but think that they can reduce the cost of doing so by building their own PKI infrastructure. Unfortunately, this often ends up being a costlier venture in terms of finances and time spent. Building a private PKI requires expertise, space for the servers, and regular maintenance. Additionally, certificate lifecycle management - from issuance to renewal to revocation - is time-consuming.

PKI as a service solutions like our JoinNow Connector PKI can save you the resources you would otherwise spend on building and maintaining your own. What’s more, since our PKI infrastructure is cloud-based, your administrators can access it from anywhere without having to replicate it at every office location.

We wouldn’t be able to call it PKI as a Service if we didn’t provide you everything you needed to manage your certificates. For endpoint distribution, we have our automatic gateway APIs for managed devices and our self-service onboarding technology for unmanaged devices/BYODs.

When it comes to revocation, our cloud based PKI can revoke certificates in a few different ways, including manually and through automatic revocation with some MDMs such as Jamf and Intune. Our PKI as a service also includes customizable policies you can create, such as non-utilization, which means certificates that aren’t used for a definable period of time (such as 60 days) are automatically revoked.

Our PKI makes renewal simple, too. For managed devices, certificate renewal typically happens on an automatic basis a month or two before the certificate’s expiration. For BYODs, administrators can set a customizable notification email to go out to end-users, encouraging them to re-enroll for a certificate before it expires.

The user experience differs based on whether they are using managed or unmanaged devices/BYODs. For managed devices, the end user will never notice the certificate enrollment process - our PKI as a service includes gateway APIs that will automatically enroll them for a certificate. For BYODs, you can utilize our self-service onboarding technology, which allows end users to configure their devices for private certificates in a matter of minutes.

After enrollment, certificate-based authentication is mostly the same for either type of end-user. They no longer need to remember a plethora of passwords, reset those passwords regularly, or adhere to complex password requirements.

Our PKI allows you to create a private certificate authority only. However, you can create as many private certificate authorities as you need. Our customers commonly build a different certificate authority for different groups of people to enable role-based access control, such as having a separate certificate authority for their HR and DevOps teams. This makes managing certificates for different roles organized and efficient.

Our best in class PKI supports a range of secure algorithms. Those include RSA 2048 & 4096, as well as ECC P256 & P384.

Public key cryptography requires the use of both public and private keys. While the public key can be sent freely, the private key must be stored securely, and we take key storage seriously as a result. The best way to guarantee your private key won’t be removed from your device is to ensure it is stored in the proper key stores and enclaves and set to non-exportable. To increase security further, we recommend that keys are stored in a device’s Trusted Platform Module (TPM) instead of storing the keys in software.

While multi-factor authentication is more secure than a simple username and password combination, it’s still the best security available. It’s simply not practical for Wi-Fi and wired security when devices move around to different locations, requiring multiple authentications. The introduction of MFA fatigue attacks, in which hackers spam users with MFA prompts until they just give in and approve them, also puts enterprises at risk. This is why organizations like CISA have recommended certificate-based authentication over MFA for increased security.