We design and deploy strong authentication and digital signing solutions that use PKI to prove identity, protect access, and produce legally binding signatures. From smart cards & tokens to FIDO2/WebAuthn and certificate‑based authentication (CBA), we align people, process, and cryptography with your compliance needs.
Strong Authentication Options (MFA, FIDO2, Smart Cards, Derived Credentials)
- FIDO2/WebAuthn: Phishing‑resistant MFA with platform (Windows Hello, Touch ID) and roaming keys (e.g., YubiKey).
- Smart Cards / PIV/CAC: Hardware‑backed credentials for workstation & privileged access; virtual smart cards where appropriate.
- Certificate‑Based Authentication (CBA): X.509 client authentication for VPN, Wi‑Fi (EAP‑TLS), web portals (mTLS), SSH/RDP, and SaaS CBA in Entra ID.
- Derived & Mobile Credentials: Issue device‑bound certs to smartphones/tablets for modern workforce and OT field use.
- Step‑up & Risk‑based MFA: Conditional policies using device trust, network, geo, and session risk.
Platforms & Integrations (Entra ID/Azure AD, AD CS, Keyfactor, Venafi)
- Microsoft Entra ID / Azure AD: CBA for Azure, Conditional Access, Windows Hello for Business, Intune/NDES SCEP.
- Microsoft AD CS: Auto‑enrolment, template hygiene, privileged access workstation (PAW) flows.
- CLM Control Planes: Keyfactor & Venafi for discovery, issuance, renewal, and policy governance.
- Edge & Network: F5/A10, Nginx, HAProxy, IIS/Apache, RADIUS/NAC (Cisco ISE/Aruba ClearPass) for EAP‑TLS.
Digital Signing (Documents, Code, Email) — eIDAS, AATL, LTV
- Document Signing: Qualified (QES) and Advanced (AdES) signatures (PAdES/XAdES/CAdES); trusted timestamping (RFC 3161); LTV profiles for long‑term validation; Adobe AATL / Microsoft trust programs.
- Remote Signing / Cloud HSM: Server‑side keys in Managed HSM or QTSP HSM with remote signing APIs (e.g., Entrust, GlobalSign DSS).
- Code Signing: HSM‑backed key protection, secure build integration (GitHub/GitLab/Azure DevOps), notarization workflows, EV code signing options.
- S/MIME Email: Identity‑bound certificates, automatic enrolment, DLP/IRM integration, DMARC alignment.
Identity Proofing & RA Workflows
- KYC/Identity Vetting: RA procedures, issuance evidence, video KYC where required for QES.
- Approval & Delegation: Role‑based signing rights, delegated signing and policy‑gated step‑up authentication.
- Audit Trails: Tamper‑evident logs, signer intent, certificate chain capture, TSA records.
Key Management & Security (BYOK, HSM, Policy Packs)
- HSM‑backed Keys: FIPS 140‑3 validated modules where mandated; dual control (M of N) ceremonies; eIDAS QES via QTSP where needed.
- BYOK / Managed HSM: Azure Key Vault / Managed HSM, AWS CloudHSM/KMS; customer key custody as default posture.
- Policy Packs: Key sizes, algorithms, validity, revocation, signer assurance levels, and archival/LTV retention.
Compliance Mapping (eIDAS/PSD2, NIS2, ISO 27001, HIPAA, PCI DSS)
- eIDAS for QES/AdES with QTSP coordination and evidence packs.
- NIS2 / ISO 27001 controls for strong auth & non‑repudiation; HIPAA for PHI workflows; PCI DSS 4.0 for code release & admin access controls.
Deliverables (What you get)
- Authentication reference architecture (on‑prem, cloud, hybrid) and enrolment playbooks (FIDO2, CBA, PIV, SCEP/EST)
- Signing architecture: QES/AdES options, TSA/LTV design, RA/identity proofing SOPs
- HSM & Ceremony packs: key generation/backup SOPs, custody forms, M of N scripts
- Template & Policy set: issuance templates, EKU rules, validity, revocation, LTV & archival policies
- Integration runbooks: VPN/Wi‑Fi EAP‑TLS, mTLS for apps/APIs, code signing in CI/CD
FAQ: Secure Authentication & Digital Signing — Common Questions
- Is FIDO2 enough, or do we still need certificates? Use FIDO2 for user login and phishing‑resistant MFA; use certificates for mTLS, devices, service auth, and many signing use cases.
- How do we get legally binding signatures? Implement AdES/QES with a QTSP or enterprise CA, include TSA and RA evidence; align to PAdES with LTV for long‑term validity.
- Can we keep keys under our control? Yes—BYOK in Managed HSM or on‑prem HSM. For QES, we coordinate QTSP custody where required by law.
- What’s the quickest win? Start with EAP‑TLS for Wi‑Fi/VPN and FIDO2 for privileged access; add document signing with LTV for legal workflows.