PKI Certificate Management Workflow Diagram

What this diagram shows

A PKI certificate management workflow diagram illustrates how digital certificates are requested, issued, renewed, and revoked within a hierarchical public key infrastructure. The flow typically begins with a certificate signing request (CSR) generated by an end entity or intermediate authority, moves through validation and issuance by a certificate authority, tracks certificate lifecycle including expiry and renewal, and concludes with revocation or expiration. The diagram shows the CA hierarchy from root CA through intermediate CAs to end entities, alongside operational processes like OCSP checks and CRL distribution that maintain trust relationships across the system.

Key components

• Root Certificate Authority — Self-signed apex certificate that issues intermediate CA certificates and anchors trust for the entire PKI system.
• Intermediate Certificate Authority — Subordinate CA that issues end-entity certificates and keeps the root CA offline for security.
• Certificate Signing Request (CSR) — Unsigned request containing the public key and identity information submitted by the applicant to the CA.
• Certificate Validation — Process where the CA verifies the CSR applicant's identity and eligibility before issuance.
• Issued Certificate — Digitally signed certificate containing the public key, identity data, validity period, and CA signature.
• Revocation List (CRL) and OCSP Responder — Systems that publish revoked certificates and provide real-time certificate status checks to relying parties.
• End Entity (Server or Client) — The final user or system that holds and uses the issued certificate for TLS, code signing, or email encryption.

When to use it

Use this diagram when documenting certificate issuance procedures, designing PKI infrastructure for organisations, training staff on certificate lifecycle management, or planning revocation strategies. It is essential for security teams implementing internal CAs, compliance documentation for regulated environments, and technical design reviews where certificate trust chains must be clearly understood. Also appropriate for communication with auditors or stakeholders who need to visualise how certificates flow from issuance through expiration or revocation.

Common mistakes

• Treating the root CA as an online issuing authority instead of offline; production PKIs keep the root CA disconnected and use intermediate CAs for day-to-day issuance.
• Omitting the revocation mechanism entirely, which leaves relying parties unable to detect compromised or cancelled certificates in active use.
• Showing certificate renewal as a simple re-use of the same certificate rather than as a distinct issuance process that generates a new certificate with a fresh validity period and signature.

Adapting it to your system

Replace the generic CA names with your organisation's actual issuing hierarchy and intermediate CA labels. Add specific validation steps your organisation performs (domain verification, identity document checks, approval workflows). Customise the revocation mechanism to match your approach (CRL distribution frequency, OCSP infrastructure, automated revocation triggers). Include certificate profiles for different use cases (TLS server, client authentication, code signing) if your PKI issues multiple certificate types. Layer in operational details such as renewal reminder timelines, key escrow procedures if applicable, and audit logging touchpoints.