// case-study: cert-portal // hybrid-cloud-security

Zero-Trust PKI & Enterprise Certificate Automation

A Zero-Trust, cloud-native PKI platform bridging Azure Cloud and on-premises Active Directory Certificate Services (AD CS) to replace legacy Microsoft certsrv with automated governance, in-browser cryptography, and enterprise approvals.

“Enterprise Public Key Infrastructure often suffers from a fundamental tension: developers need instant, frictionless SSL/TLS and code-signing certificates, while security teams must guarantee strict key custody, approval oversight, and regulatory auditability. By pairing in-browser cryptographic generation with a hardened cloud-to-on-prem hybrid pipeline, Cert-Portal delivers speed without compromising on Zero-Trust security.”
Zero Server-Side KeysCAB Forum SC31 397-Day CapgMSA Air-Gapped CA Bridge100% NIS2 / ISO 27001 Audit Trail
Explore Architecture ↓Problem vs. Solution ↓Core Capabilities ↓Technical Specs ↓
01

Key Facts & System Specifications

High-level architectural blueprint and specification summary of the cert-portal implementation.

CategorySpecification & Architectural Decision
Project TypeEnterprise Security & PKI Modernization / Hybrid Cloud Platform
Core ArchitectureCloud-Native Serverless Frontend & API + Hybrid Runbook Worker to On-Prem AD CS
Primary UsersDevelopers, DevOps/SysAdmins (Requesters), Security Leads (Approvers), PKI Engineers (Admins)
Security ParadigmZero-Trust Key Custody: Private keys generated in-browser via WebCrypto; server never sees private keys
Identity & AuthEntra ID (Azure AD) OIDC/PKCE via MSAL.js, App Roles (Admin.Templates.Write, Approver.Requests), gMSA on-prem
Frontend StackReact 18, TypeScript, Vite, Tailwind CSS, shadcn/ui, TanStack Query, React Hook Form + Zod, WebCrypto / PKI.js
Backend StackAzure Functions v2 (Python 3.11 Flex Consumption FC1), Azure Easy Auth, cryptography library
Data & StorageAzure PostgreSQL Flexible Server (Managed Identity Auth — zero passwords in config), Azure Key Vault
Hybrid OrchestrationAzure Automation + Hybrid Runbook Worker (PowerShell 7 / PSPKI / certreq), OAuth daemon webhook callbacks
Compliance & StandardsCAB Forum SC31 (397-day validity cap), NIS2 Directive, ISO/IEC 27001 (immutable request-to-issuance audit trail)
Infrastructure as CodeModular Azure Bicep (infra/backend, infra/frontend), Azure DevOps CI/CD
02

The Problem vs. The Engineered Solution

Replacing decades-old operational friction and risky certificate workflows with modern cloud-native guardrails.

Legacy PKI Enrollment

Microsoft certsrv
  • ✕
    The Antiquated certsrv Legacy
    Decades-old Microsoft ASP web enrollment tool lacking modern MFA, responsive mobile design, and granular RBAC.
  • ✕
    Server-Side Key Compromise Risk
    Server-side key generation creates a catastrophic single point of failure and violates ISO 27001 key custody principles.
  • ✕
    Wildcard & Shadow Cert Sprawl
    Engineers routinely issue long-lived wildcard certificates (*.domain.com) without security oversight, creating massive blast radiuses.
  • ✕
    Over-Privileged CA Access
    Users and admins are granted direct enrollment rights on Active Directory Certificate Services (AD CS), bypassing governance.
  • ✕
    Certificate Outages & Compliance Gaps
    Expired certificates cause unexpected downtime, while unlinked issuance records fail modern regulatory audits (NIS2).

Cert-Portal Platform

Zero-Trust & Serverless
  • ✓
    Frictionless Self-Service SPA
    Modern React 18 dashboard with standardized templates (Web Server, Code Signing, Client Auth) and real-time schema validation.
  • ✓
    Zero-Trust Browser-Side Cryptography
    RSA 2048/4096 & ECDSA P-256/384 keypairs and PKCS#10 CSRs are generated inside the browser with native window.crypto.subtle.
  • ✓
    Multi-Channel Approval Engine
    High-risk requests (wildcards / sensitive templates) trigger interactive Microsoft Teams Adaptive Cards and Graph emails.
  • ✓
    Hardened Hybrid Execution (gMSA)
    Requesters never touch the CA. Enrollments execute via an isolated Group Managed Service Account on Hybrid Runbook Workers.
  • ✓
    Proactive Health & 30-Day Monitor
    Live status board tracking certificate health with proactive ≤30-day warnings, 1-click renewals, and immutable audit logs.
03

End-to-End Hybrid System Architecture

Cloud-native frontend and serverless API seamlessly connected to on-premises Microsoft AD CS through hardened hybrid runbook workers.

☁️ Azure Cloud Infrastructure (Managed Identity & Easy Auth)React 18 SPA (Static Web App)• In-Browser WebCrypto Keygen• MSAL.js Entra ID OIDC / PKCE• PKCS#12 / PFX 3DES ExporterAzure Functions Flex FC1• Python 3.11 + Easy Auth OIDC• CAB Forum 397-Day Policy Guard• Role Auth: Admin.Templates.Write🔑 Microsoft Entra IDRBAC Claims & App Roles🐘 Azure Postgres FlexibleManaged Identity (Zero Password)💬 Teams & Graph WebhookInteractive Adaptive Cards1-Click Approver Actions⚙️ Azure AutomationManaged Identity DaemonHybrid Worker Dispatcher🏢 On-Premises Network (Secured via VPN / ExpressRoute)Hybrid Runbook Worker• PowerShell 7 + PSPKI• Strictly runs as gMSAMicrosoft AD CS (CA)• Enrollment ONLY for gMSA• Zero direct user accessREST / CSRHybrid Job Dispatchcertreq submit

Certificate Request & Issuance Lifecycle

STAGE 01
Client Keygen & CSR
Requester configures SANs. Browser WebCrypto generates RSA/ECDSA keypair and signs PKCS#10 CSR locally. Private key stays in browser memory.
STAGE 02
Policy & Role Guard
Azure Function FC1 evaluates Easy Auth Entra ID token, applies CAB Forum 397-day validity clamping, and validates subject regex rules.
STAGE 03
Teams Approval Gating
If request contains wildcard SANs or restricted templates, an interactive Adaptive Card is dispatched to Teams for 1-click approver sign-off.
STAGE 04
Air-Gapped gMSA Bridge
Azure Automation dispatches job to On-Prem Hybrid Runbook Worker. gMSA submits CSR via certreq with RequestID GUID tracking attribute.
STAGE 05
Issuance & Audit Log
AD CS issues X.509 cert. Requester downloads CRT, PEM, or password-protected PFX bundle (PKCS#12 3DES). Event logged to Postgres for NIS2.
04

Core Capabilities Showcase

Production-engineered security primitives and compliance mechanisms built into cert-portal.

🛡️
Zero-Trust In-Browser Cryptography

Generates asymmetric keypairs (RSA 2048/4096-bit, ECDSA P-256/P-384) and constructs signed PKCS#10 CSRs directly within the browser using WebCrypto (window.crypto.subtle) and pkijs.

Security ImpactPrivate keys never leave browser memory. Zero wire transmission, zero server storage, complete key custody.
⚙️
Automated Governance & 397-Day Cap

Validates CSR subject fields, SAN formatting, key algorithms, and validity periods against declarative template rules before hitting the CA. Automatically extracts Entra ID claims for CodeSigning-UserUPN templates.

Compliance AlignmentEnforces CAB Forum Ballot SC31 (397-day max validity cap), preventing browser errors (NET::ERR_CERT_VALIDITY_TOO_LONG).
🚦
Smart Multi-Channel Approval Engine

Automatically intercepts high-risk certificate requests (wildcard SANs or sensitive templates) and dispatches interactive Microsoft Teams Adaptive Cards and Graph emails to authorized approvers.

Operational ControlApprovers review requester identity, requested SANs, and template constraints directly from Teams with 1-click decisions.
🔒
Air-Gapped gMSA CA Bridge

Direct enrollment permissions are completely removed from users on AD CS. Requests flow through Azure Automation to an on-premise Hybrid Runbook Worker running strictly under a Group Managed Service Account (gMSA).

Blast Radius IsolationInjected RequestID GUID attribute links CA event logs directly back to the cloud audit trail.
📊
Real-Time Expiration & Health Monitor

Administrative dashboard displaying live certificate health categorized into Valid & Active, Expiring Soon (≤ 30 Days), and Expired / Locked, with 1-click renewal workflows.

Outage PreventionEliminates unexpected certificate expirations and provides 1-click re-issuance with pre-filled SAN parameters.
📜
NIS2 & ISO 27001 Audit Trail

Every request, template modification, approval decision, CA submission, and issuance event writes to an append-only, indexed audit_log in Azure PostgreSQL Flexible Server.

Audit AttributionCorrelates requester UPN, approver UPN, timestamp, client IP, CA thumbprint, and cryptographic serial number.
05

Technical Stack & Security Deep-Dive

Component breakdown and enterprise security posture powering the end-to-end platform.

User Interface
React 18 · Vite · TypeScript
Dark-mode SPA with responsive forms, client-side validation, and instant feedback.
Component Library
shadcn/ui · Tailwind CSS
Accessible, polished UI primitives tailored to technical operations workflows.
State & Querying
TanStack Query v5 · MSAL.js
Real-time status polling, request cache management, and Entra ID OIDC / PKCE auth.
Client Cryptography
WebCrypto API · PKI.js
Zero-Trust browser-side keypair generation and PKCS#12 / PFX 3DES bundle packaging.
Serverless API
Azure Functions (Python 3.11)
Easy Auth integration, CSR inspection, policy clamping, and webhook dispatching.
Compute Tier
Flex Consumption (FC1)
Fast cold starts and rapid event-driven scaling with zero idle compute waste.
Relational Database
Azure PostgreSQL Flexible
Managed Identity authentication with zero passwords stored in application code or configuration.
Secrets & Cryptography
Azure Key Vault
Secure storage for operational credentials and system signing metadata.
Hybrid Automation
Azure Automation + HRW
Hybrid Runbook Worker running PowerShell 7 and PSPKI under an isolated gMSA.
Enterprise PKI
Microsoft AD CS (Windows Server)
Enterprise Intermediate CA with CAB Forum SC31 lifetime policy constraints.
Infrastructure as Code
Modular Azure Bicep
Reproducible declarative deployments across backend, networking, and frontend tiers.
DevOps & CI/CD
Azure DevOps Pipelines
Automated linting, pytest & Vitest test suites, and multi-stage bicep validation.

🔐 Security & Identity Architecture Highlights

Passwordless Cloud Infrastructure
The Azure Function App connects to Azure PostgreSQL and Key Vault using Azure Managed Identities (ManagedIdentityCredential). Zero database passwords or connection strings exist in source code or configuration files.
Granular Entra ID RBAC Enforcement
Role-based gating protects every operational tier: Requester routing via group memberships (AllowedRequesterGroups), Administrative routes guarded by Admin.Templates.Write, and Approver actions restricted to Approver.Requests.
Zero-Trust Network Isolation
Flex Consumption Functions operate within delegated Virtual Network subnets. PostgreSQL Flexible Server and Key Vault instances are strictly accessible via Azure Private Endpoints, eliminating public internet exposure.
06

Business Impact & Measurable Outcomes

Quantifiable results achieved by replacing legacy manual certificate enrollment with automated Zero-Trust governance.

100%
CA Privilege Elimination
Human direct enrollment permissions completely revoked from the CA, funneling all issuance through auditable guardrails.
0
Server Key Exfiltration Risk
Zero private keys stored, transmitted, or accessible to cloud APIs due to browser-native WebCrypto key generation.
90%
Provisioning Lead-Time Reduction
Automated CSR validation, pre-configured templates, and 1-click Teams approvals cut turnaround from days to minutes.
// Implementation NoteAll components shown in this case study represent production-grade architecture implemented in this repository (cert-portal), featuring full Infrastructure-as-Code (Bicep), automated unit/integration test suites (pytest & Vitest), and enterprise security patterns.
← Back to All ProjectsDiscuss an Engagement →