Certificate Signing Request (CSR)

​

Certificate Signing Request Generation

KryptoVault enables organizations to generate Certificate Signing Requests as part of a controlled certificate lifecycle. A CSR contains the iNdentity and cryptographic information required by a certificate authority to issue a certificate. By generating CSRs through KryptoVault, organizations can standardize request creation and ensure that certificate requests follow approved cryptographic and governance practices. CSR generation can be integrated with private-key creation or existing key material, depending on the certificate workflow.

​

Centralized Issuance Workflow

Once a CSR has been created, KryptoVault can route the request to the appropriate configured issuer. The issuance process can be connected with supported issuer technologies such as:

• ACME
• Microsoft AD CS through KryptoVault Gateway
• Vault PKI

This allows different certificate authority technologies to participate in a common certificate issuance model. KryptoVault acts as the orchestration and governance layer, while the connected certificate authority remains responsible for certificate signing.

​

Issuer-Based Certificate Issuance

Certificate issuance is performed through the issuer associated with the request. The selected issuer determines the certificate authority environment responsible for signing the CSR and producing the final certificate. This enables organizations to support multiple issuance models within the same platform, including enterprise PKI, automated certificate services, and cloud-native PKI environments.

​

Cryptographic Key Association

Certificate issuance is closely linked with private-key management. A CSR is created using a cryptographic key pair, and the issued certificate is associated with the corresponding private key. Maintaining this relationship within KryptoVault helps ensure that certificate and key material remain connected throughout the lifecycle. This relationship supports later activities such as renewal, replacement, deployment, and key rotation.

​

Certificate Request Lifecycle

KryptoVault maintains the lifecycle of certificate requests from creation through issuance. A request can progress through controlled processing stages such as creation, validation, submission, signing, import, rejection, or cancellation. This lifecycle model provides visibility into the state of certificate requests and helps distinguish pending certificate operations from completed issuance.

​

Request Validation

Before certificate issuance, KryptoVault can validate the certificate request against applicable rules and issuer requirements. Validation can help confirm that the request is suitable for submission and that the cryptographic and identity information meets the expected certificate policy. This reduces invalid certificate requests and improves consistency across issuance workflows.

​

Certificate Signing

After validation, the CSR is submitted to the configured certificate authority for signing. The certificate authority applies its own certificate policy, trust model, validity rules, and signing configuration. Once signing is completed, the resulting certificate is returned to KryptoVault and incorporated into the managed certificate lifecycle.

​

Certificate Onboarding

Issued certificates can be automatically added to the centralized certificate inventory. Once onboarded, the certificate becomes available for:

• Lifecycle monitoring
• Expiration tracking
• Certificate validation
• Cryptographic analysis
• Risk assessment
• Certificate-store association
• Private-key association

This ensures that certificates created through issuance workflows are managed consistently with certificates discovered or imported from other sources.

​

Certificate Store Integration

Issued certificates can be associated with an appropriate certificate store. This provides operational context for where the certificate is intended to be managed or deployed. Certificate-store integration also supports future lifecycle events such as renewal, replacement, and migration.

​

Multi-Issuer Issuance

KryptoVault supports issuance across multiple certificate authority technologies. For example, an organization may use:

• AD CS for internal enterprise certificates
• ACME for automated public-facing certificates
• Vault PKI for application or cloud-native workloads

KryptoVault provides a common issuance layer across these issuer technologies. This allows organizations to maintain different PKI platforms while applying consistent certificate governance.

​

Automated Certificate Issuance

Certificate issuance can be automated where supported by the connected certificate authority. Automation helps reduce manual PKI administration and enables certificate operations to scale across large application and infrastructure environments. Automated issuance is particularly useful for short-lived certificates, cloud-native environments, APIs, and frequently changing infrastructure.

​

Certificate Renewal

The CSR & Issuance capability also supports certificate renewal workflows. When a managed certificate approaches expiration, a new request can be generated and submitted to the appropriate issuer. The replacement certificate remains connected to the existing certificate lifecycle, certificate store, and operational context. This helps reduce manual renewal effort and lowers the risk of certificate-related outages.

​

Issuance Governance

Certificate issuance is governed through KryptoVault’s role-based access control model. Organizations can restrict certificate request creation, issuer usage, signing operations, and lifecycle actions to authorized users or roles. This helps enforce separation of duties between certificate consumers, PKI administrators, security teams, and infrastructure operators. The existing KeyManager requirements define the underlying role and permission model for these controls.

​

Audit and Traceability

KryptoVault maintains traceability across certificate request and issuance activity. This allows organizations to understand when a certificate request was created, how it progressed through the issuance process, which issuer was used, and how the resulting certificate entered the inventory. Audit visibility supports compliance, troubleshooting, security review, and operational accountability.

​

Integration with Inventory & Private Keys

CSR & Issuance is directly connected with KryptoVault Inventory & Private Keys. The issued certificate becomes part of the centralized certificate inventory, while the associated key remains linked to the certificate. This provides continuity between certificate creation and ongoing lifecycle management.

​

Integration with Issuers & Remote CA

CSR & Issuance relies on the configured issuer framework to complete certificate signing. This creates a direct relationship between certificate requests and the organization’s PKI infrastructure. The same issuance model can therefore operate across ACME, AD CS through Gateway, and Vault PKI.

​

Integration with Certificate Stores

Certificate Stores provide the operational destination context for issued certificates. This ensures that certificates created through issuance workflows are not managed in isolation but remain connected with the applications, environments, or infrastructure where they are used.