This is a really neat solution, as finding a really good enterprise-y solution that meets the needs for hardware encryption, offline ca's, all that good stuff i

This is a really neat solution, as finding a really good enterprise-y solution that meets the needs for hardware encryption, offline ca's, all that good stuff is really hard to find that doesn't suck. Active Directory Certificate Services has long been the defacto for windoze shops still, but a security nightmare, and most every 3rd party solution really isn't much better, not to mention stupidly expensive. Almost all are tailored toward replacing ADCS, but do so in hardly "good" ways. I'm helping a customer test Yubikey HSM2's to bootstrap an enterprise PKI, this is both cheaper and better for all the normal Yubikeys, SBC, and a nice open solution to make use of them. I really wish I saw this a few months ago. It's a shame it's 2025 and still so elusive to find good PKI solutions out there for both big and small businesses. This sort of project keeps some hope alive!