Future-proof IAM and certificate management for a global industrial group

Challenge
Creating and managing secure authentication systems within the group

Digital trust is the currency of the modern economy. Ensuring that all communication between systems, machines and staff is authentic and encrypted forms the basis for the integrity of all business processes and is a core component of any Zero Trust architecture. Seamless management of these trust anchors not only protects the organisation from cyber risks, but also safeguards its reputation with customers and partners.

Digital certificates are therefore essential in a modern IT infrastructure. You can think of them as identity cards for computers and software applications: they ensure that systems trust one another and that only authorised parties are permitted to communicate with one another. The number of these certificates can vary depending on the size of the organisation, based on the number of employees and the hardware and software in use. In the case of our client, a global industrial group, we are talking about several million of these certificates.

Management therefore becomes a daunting task, as certificates must be regularly renewed, updated or revoked if they are no longer in use. In addition, the development of quantum computers – which will be capable of cracking classical asymmetric encryption algorithms – poses a strategic risk both to our clients and to all organisations with extensive systems. Organisations must therefore take action now to adapt their security measures in line with the recommendations of the Federal Office for Information Security (BSI), implementing quantum-secure algorithms by 2031 – and by 2030 for critical applications. General preparedness is also recommended by the National Institute of Standards and Technology (NIST) guidelines and is an essential component of modern risk management and supply chain security.

Approach to a solution
Strategic modernisation and safeguarding the future of the certification landscape

Working alongside the client, Comma Soft has established a process to carry out a comprehensive review of the existing certificate landscape. The aim was to achieve complete transparency regarding which certificates exist and where they are used. At the same time, the system was upgraded to higher security levels, as recommended by the BSI.

Building on this, a shared vision for the future was developed with the aim of making the infrastructure ‘post-quantum-ready’ using modern algorithms. This involves planning the transition to new, quantum-secure encryption methods. In doing so, critical constraints were analysed: new certificate algorithms, such as those with increased key lengths, may increase the load on the systems or be incompatible with older applications. This detailed assessment ensures that the migration takes place without any disruption to ongoing operations.

Target scenario
Modernised certificate infrastructure and cloud IAM

The industrial group now has a clear strategy for action to modernise its certificate environment in stages. The strategic roadmap sets out a clear direction on how to safeguard the system against the threats posed by quantum technology through timely migration. By taking into account the technical system load and compatibility, potential risks of failure were identified and eliminated at an early stage. The following interim results serve as the basis for implementing the roadmap:

• Identification of suitable algorithms: To ensure an optimal balance between maximum compatibility and state-of-the-art security standards, algorithms are selected on a case-by-case basis. RSA with an increased key length is used as the standard to enable broad integration into existing systems and to meet current BSI recommendations and customer-specific security requirements. For more modern end devices and specific use cases where greater efficiency is required, the asymmetric cryptosystems ECDSA 256 or EDSA 384 are selected as high-performance alternatives. In parallel, combinations of currently standardised post-quantum methods are already being evaluated in order to lay the foundations for a future, quantum-secure migration through targeted testing.
• Personalised migration timeline: The migration is designed as a multi-stage process, beginning with the transition to the Microsoft Cloud PKI. This first step acts as a ‘quick win’, as it enables the existing infrastructure to be relieved of load rapidly and leads directly to cost savings. At the same time, this phase serves as a pilot project to test the migration processes and define the necessary stakeholder involvement. Building on this validated foundation, the migration strategy is then gradually extended to cover further use cases. In a subsequent step, ongoing dialogue with stakeholders is utilised to plan and implement proofs of concept (PoCs) for post-quantum scenarios.
• Role-based approach to managing the new infrastructure: To ensure the efficient management of the new infrastructure, a detailed role-based concept is being developed, based on user-defined roles within Entra ID with permissions to manage the cloud PKI. The aim is to define responsibilities precisely and to establish a clear division of tasks (scoping). As part of this concept, fundamental governance issues are clarified, particularly with regard to administrative responsibility: It must be determined whether the PKI is to be managed via Intune by Intune administrators, PKI managers or a jointly formed group, and what specific permissions are required for this. This marks a strategic shift from purely infrastructural management towards integration with Intune as the central governance tool for identity lifecycle management.
• Migration to Microsoft solutions:  A key pillar of the modernisation is the migration to Cloud PKI, which will be included in the E5 licence from August 2026. This transition reduces reliance on local infrastructure and optimises operating costs. The migration will take place in stages via defined test groups to ensure maximum stability. Further details and technical specifications regarding this transition can be found in the relevant blog post.