DuoKey

Automotive manufacturer · Automotive · PKI

PKI and certificate lifecycle, automated end to end.

An automotive manufacturer uses DuoKey to run its PKI and automate the certificate lifecycle across IT, plants and connected services, so an expired certificate no longer stops the business.

Book a callPKI & certificate management

The problem

Certificates sit everywhere: servers, plant equipment, back-end services and supplier connections. Tracked in spreadsheets and renewed through tickets, they expire unnoticed and cause outages. Shrinking public TLS lifetimes make manual renewal impossible to sustain.

How DuoKey helps

DuoKey brings the certificate authorities and certificates into one inventory, applies issuance policies and automates enrolment and renewal through ACME, EST, SCEP and CMP. CA keys are protected with MPC, and every issuance is recorded.

How it works

Step by step, where the keys go

Plantexpires in 3 daysrenewed · ACMEServerVehicleSupplierAPI gatewayKubernetesCACA KEYS ON MPCECDSAPolicy · 90 d · P-256ACMEESTSCEPCMP

  1. 01 / 04

    Discover every certificate

    DuoKey scans plants, servers, vehicle back-ends, supplier links, API gateways and Kubernetes clusters, and flags what is about to expire.

  2. 02 / 04

    Issue under policy

    Certificates come from CAs whose keys are protected with MPC, with key types, lifetimes and approvers set by policy.

  3. 03 / 04

    Renew before anything breaks

    Expiring certificates renew automatically over ACME, EST, SCEP or CMP. The outage never happens.

  4. 04 / 04

    Switch to post-quantum when ready

    The same CA can move to ML-DSA and re-issue certificates across the estate, without changing the automation.

Security leadership

The questions this programme had to answer

What changed

How DuoKey takes the manufacturer's PKI off the ticket queue

  • Inventory

    Every certificate, one view

    Owners, expiry dates and issuing CAs are visible in one place instead of spreadsheets.

  • Auto

    Renewal before expiry

    Enrolment and renewal run through ACME, EST, SCEP and CMP, without manual tickets.

  • Policy

    Issuance under rules

    Key types, lifetimes and approvers are set by policy for each CA and use case.

  • PQC

    Ready for post-quantum CAs

    The same platform can issue from ML-DSA and hybrid CAs when the migration starts.

More programmes

Volkswagen

OTA that stays under OEM authority.

View case study

ICRC

Beneficiary data sealed by keys the ICRC controls.

View case study

Swiss energy operator

Board papers protected with a key Microsoft does not hold.

View case study

Major German bank

Microsoft 365 for a bank, with the key in the bank's hands.

View case study

Swiss fintech bank

Blockchain transactions signed without a complete key ever existing.

View case study

OpenBAO Migration

Vault to OpenBAO Migration

View case study

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform