Encryption Consulting

Certificate lifecycle management is not a topic that makes anyone lean forward. It sits in the same mental folder as backups and patch schedules: important, unglamorous, and easy to push to next quarter.

Right up until a certificate expires in the wrong place and takes a payment system, a login flow, or an entire customer-facing service down with it.

Tha...

ML-DSA-44 signature is 2,420 bytes. An ECDSA P-256 signature is 72 bytes. That is a 33x jump, and it lands in every certificate chain, every TLS handshake, and every embedded device with a fixed buffer size in your environment. You can read that number in a standard. You only feel it when you issue the certificate and watch what breaks.

That gap between having read...

Ask a release engineer how many signing tools their organization runs and watch them actually stop and count on their fingers. Signtool for the Windows installer. Jarsigner for the one Java service nobody wants to touch. Whatever the mobile team wired up for APKs. A GPG key somebody set up for the Debian repository three engineers ago, and nobody’s fully sure who still has it...

A network engineer capturing a packet trace today can hold onto that capture for a decade, and so can an adversary sitting on the same wire. That pattern, known as harvest-now, dec...

Active Directory Certificate Services (AD CS) is Microsoft’s role-based PKI platform for Windows Server that issues, manages, and revokes certificates for domain-joined users, devices, and services, and requires deliberate hardening to avoid well-documented misconfiguration-based attack paths.

AD CS lets organizations run an internal Certificate Authority integrated...