9 Issuing CAs. Expiring Root. A Global Retailer’s PKI Assessed, Consolidated, and Rebuilt 

[cs_hero title_colored = "9 Issuing CAs. Expiring Root." title_after = "A Global Retailer's PKI Assessed, Consolidated, and Rebuilt" industry = "Retail, Global E-Commerce & Physical Stores" engagement_type = "PKI Assessment & Deployment (Infrastructure Modernization)" download_url = "https://preview.encryptionconsulting.com/wp-content/downloads/case-studies/A-Global-Retailer-PKI-Assessed-Consolidated-and-Rebuilt.pdf" ] [cs_excerpt] How Encryption Consulting assessed a global retailer's aging PKI, migrated from ADCS 2008 to 2016 R2, consolidated 9 Issuing CAs to 4, deployed HSMs with Key Ceremony procedures, and enabled support for MDM, VPN, and IoT certificate requirements. [/cs_excerpt] [cs_profile_desc] A global retail organization with physical and online stores selling clothing, electronics, groceries, and home essentials. Employs thousands worldwide with a focus on sustainable practices and customer trust. [/cs_profile_desc] [cs_at_a_glance stat1="9 → 4" label1="Issuing CAs consolidated, reducing infrastructure and maintenance costs" stat2="ADCS 2016" label2="New PKI service replacing end-of-support ADCS 2008" stat3="FIPS 140-2" label3="Level 3 HSM deployed for Root CA and ICA key storage" stat4="MDM·VPN·IoT" label4="New certificate requirements enabled across the organization" ] [/cs_hero] [cs_challenges desc=”The organization’s PKI had grown without structured planning, running on an end-of-support platform with an expiring Root CA, no governance documentation, insufficient skilled resources, and keys stored outside secure hardware.”] [cs_challenge icon=”0″ title=”No certificate tracking or planning” tag=”PLANNING”] Lost track of issued certificates, expiry dates, and locations. No PKI operations planning, leading to failed audits and misuse risks. [/cs_challenge] [cs_challenge icon=”1″ title=”Expiring Root CA on ADCS 2008″ tag=”ROOT CA”] Root CA on end-of-support ADCS 2008 with an expiring certificate. No regular CPS audits conducted, putting certificate chain trust at risk. [/cs_challenge] [cs_challenge icon=”2″ title=”Insufficient skilled PKI resources” tag=”Resources”] Lacked dedicated PKI personnel to manage infrastructure, respond to outages, or handle security incidents. In-house PKI was underresourced. [/cs_challenge] [/cs_challenges]

[cs_quote author=”Encryption Consulting” role=”Engagement Summary · Encryption Consulting · PKI Services”] The PKI had grown with the business but without a plan. An expiring Root CA on end-of-support infrastructure, 9 uncoordinated Issuing CAs, and keys outside secure hardware needed a full rebuild. [/cs_quote]

[cs_divider]

[cs_solutions desc=”The engagement covered a full PKI assessment, platform migration, CA consolidation, HSM deployment with Key Ceremony, hierarchy redesign with offline Root CA, template validation, and CRL distribution configuration.”] [cs_solution title=”PKI Assessment & ADCS Migration” image_url=”https://ecwebsitedata.blob.core.windows.net/encryption-consulting-website-data/2026/07/A-Global-Retailer-PKI-Assessed-Consolidated-and-Rebuilt-solution-banner-1.jpg”] Assessed the existing PKI and designed a new ADCS 2016 R2 service, resolving Root CA expiry and replacing end-of-support ADCS 2008. [/cs_solution] [cs_solution title=”CP/CPS & CA Consolidation” image_url=”https://ecwebsitedata.blob.core.windows.net/encryption-consulting-website-data/2026/07/A-Global-Retailer-PKI-Assessed-Consolidated-and-Rebuilt-solution-banner-2.jpg”] Created CP/CPS documents, consolidated 9 Issuing CAs to 4, and established governance procedures while reducing redundancy and infrastructure costs. [/cs_solution] [cs_solution title=”HSM, Key Ceremony & Hierarchy” image_url=”https://ecwebsitedata.blob.core.windows.net/encryption-consulting-website-data/2026/07/A-Global-Retailer-PKI-Assessed-Consolidated-and-Rebuilt-solution-banner-3.jpg”] Deployed FIPS 140-2 Level 3 HSMs for Root/ICA key storage, defined Key Ceremony procedures with custodian roles and responsibilities, and built an offline Root CA hierarchy with 4 Issuing CAs across 4 domain forests. [/cs_solution] [cs_solution title=”Template & CRL Distribution” image_url=”https://ecwebsitedata.blob.core.windows.net/encryption-consulting-website-data/2026/07/A-Global-Retailer-PKI-Assessed-Consolidated-and-Rebuilt-solution-banner-4.jpg”] Validated and created certificate templates for MDM, VPN, and IoT requirements. Configured HTTP and LDAP as CRL Distribution Points. [/cs_solution] [/cs_solutions]

[cs_quote direction=”rtl” author=”Encryption Consulting” role=”Engagement Summary · Encryption Consulting · PKI Services”] The result was a rebuilt PKI with a secure offline Root CA, consolidated Issuing CAs, HSM-protected keys, governance documentation, and certificate templates covering current and planned requirements. [/cs_quote]

[cs_divider]

[cs_outcomes desc=”The PKI assessment and deployment gave the organization a documented, modern PKI infrastructure with defined people, processes, and technology to manage it long-term.”] [cs_outcome title=”Consolidated infrastructure, reduced costs”] Consolidated 9 Issuing CAs to 4, reducing redundant infrastructure and maintenance costs. ADCS 2016 R2 replaced the end-of-support system, eliminating Root CA expiry risk. [/cs_outcome] [cs_outcome title=”Audit readiness and governance”] CP/CPS documentation, custodian roles, and Key Ceremony procedures gave auditors all required information. People, processes, and technology defined for ongoing PKI management. [/cs_outcome] [cs_outcome title=”New certificate demands enabled”] Enabled MDM, VPN, and IoT requirements through validated and new templates. Issued certificates with a trusted chain for internal web applications, preparing PKI for future needs. [/cs_outcome] [/cs_outcomes]

[ecresourcessection]