Security Best Practices When Using PKI as a Service for EAP-TLS
Even with a trusted cloud PKI provider, organizations must actively own certificate policy, enrollment security, revocation, and monitoring to maintain a strong posture for certificate-based Wi-Fi authentication.
PKI as a Service significantly reduces the operational burden of running an internal certificate authority, but it does not eliminate the need for strong security practices. The provider manages the infrastructure; the customer remains responsible for policy design, secure bootstrap of trust, timely revocation, and continuous monitoring — especially critical when certificates are used for EAP-TLS on Wi-Fi networks that carry sensitive traffic and must support high device volumes.
The organizations that get the best security outcomes treat PKIaaS as a powerful tool that still requires deliberate configuration and oversight, integrated tightly with their onboarding platform and existing AAA infrastructure.
- • PKIaaS shifts operational risk but does not remove accountability for certificate policy and governance.
- • The most common security gaps are weak bootstrap trust and inadequate revocation processes.
- • Certificate templates must be purpose-built for Wi-Fi client authentication (correct EKUs, key usage, validity periods).
- • OCSP is strongly preferred over CRL for Wi-Fi due to timeliness and network efficiency.
- • Continuous monitoring of enrollment patterns and certificate usage is essential for detecting compromise or misconfiguration.
- • PKIaaS works best when tightly integrated with a dedicated onboarding platform and your existing identity/AAA systems.
Shared Responsibility Model
With PKI as a Service, the division of responsibilities is clear but often misunderstood:
- • CA infrastructure and HSM security
- • High availability and disaster recovery
- • Physical and logical security of the CA
- • Compliance certifications (SOC 2, etc.)
- • Core software patching and updates
- • Certificate policy and template design
- • Secure bootstrap and enrollment processes
- • Revocation policy and execution
- • Monitoring and anomaly detection
- • Integration with identity systems
- • Device-side key protection
Many security incidents involving PKIaaS stem from customers assuming the provider handles everything. They do not.
Certificate Policy and Template Design
One of the most important areas customers must own is the design of certificate templates used for EAP-TLS.
Best practices include:
- Use separate templates for different device/user types (staff, guest, IoT, servers).
- Restrict Key Usage and Extended Key Usage (EKU) strictly to client authentication (and server auth where appropriate). Avoid unnecessary usages.
- Set reasonable validity periods (e.g., 1–2 years for user devices, shorter for high-risk IoT).
- Include unique identifiers (e.g., hardware serial or user principal name) that map back to your identity system for auditing.
- Apply name constraints or other policy restrictions where supported by your PKIaaS provider.
Regularly audit which templates are actually being used for Wi-Fi authentication and ensure they have not drifted over time.
Secure Bootstrap of Trust
Before a device can receive a certificate, it must initially trust the PKIaaS CA. This "bootstrap" phase is one of the highest-risk parts of any PKI deployment.
Recommended approaches:
- Use manufacturer-installed trust anchors where possible (many modern devices ship with common public roots).
- For SCEP/EST enrollment, require strong authentication of the enrollment request (e.g., challenge password, OAuth token, or pre-issued bootstrap certificate).
- Avoid "trust on first use" models for production environments.
- Where possible, perform initial enrollment over a trusted network or with additional out-of-band verification.
Secure bootstrap is critical — a compromised enrollment process can undermine the entire certificate-based authentication system.
Revocation Strategy
Revocation is essential for lost, stolen, or compromised devices, and for rapid offboarding of staff.
Best practices for Wi-Fi environments:
- Prefer OCSP over CRLs for timeliness and lower bandwidth usage on the client side.
- Ensure your PKIaaS provider offers reliable, highly available OCSP responders.
- Configure short validity periods combined with automatic renewal rather than relying solely on revocation for normal device lifecycle.
- Automate revocation triggers from your HR/identity system and from MDM/UEM platforms.
- Monitor for OCSP or CRL failures — these can cause widespread authentication outages if not caught early.
Monitoring and Anomaly Detection
Even the best policy is ineffective without visibility.
Monitor for:
- Unusual enrollment volumes or patterns (possible bulk compromise).
- Certificates being issued for unexpected device types or locations.
- High rates of authentication failures or successes from suspicious sources.
- Revocation list or OCSP responder health.
- Certificate usage that does not match expected behavior (e.g., a user certificate suddenly used from many devices).
Feed PKI events into your SIEM and correlate them with other identity and network telemetry.
Additional technical considerations:
- Regularly review and restrict the certificate templates exposed to your onboarding platform.
- Implement certificate pinning or strict trust store controls on high-security devices where feasible.
- Ensure device private keys are generated on-device (or in secure elements) and never leave the device.
- Test revocation end-to-end regularly, including under load.
- Document your certificate policy clearly and have it reviewed by security/compliance teams.
- When using a PKIaaS provider, understand their incident response process and your contractual rights to logs and audit data.
The combination of PKIaaS + a strong dedicated onboarding layer gives you powerful tools — but only if you configure and monitor them deliberately.
PKI as a Service is a major operational win for most organizations running EAP-TLS at scale, but it is not a "set and forget" solution. Security depends on deliberate policy design, secure enrollment processes, aggressive revocation, and continuous monitoring. Organizations that treat PKIaaS as a shared responsibility model — and integrate it tightly with their onboarding platform and AAA — achieve both stronger security and better operational outcomes.
We help teams design secure, practical PKIaaS architectures for enterprise Wi-Fi.