PKI Standards Compliance

Public Key Infrastructure (PKI) establishes digital trust by using certificates and cryptographic keys to authenticate identities, encrypt communications, and support digital signatures. But for certificates and PKI systems to work securely across applications, devices, organizations, and vendors, they must follow established standards.

PKI standards define areas such as certificate formats, cryptographic algorithms, key management, certificate issuance and revocation, trust policies, and interoperability. Which standards apply depends on the environment. A private enterprise PKI, U.S. Federal PKI, and publicly trusted WebPKI may all use X.509 certificates, for example, but operate under different policies and compliance requirements.

For organizations, PKI compliance begins with identifying the certificate policy, applicable standards, trust framework, contractual requirements, and relying-party requirements for the specific use cases. Organizations must then operate documented controls and retain evidence sufficient to demonstrate conformity with those requirements while confirming that compliance requires visibility and governance across both human and non-human identities.

Modern PKI draws on standards from organizations including the Internet Engineering Task Force (IETF), National Institute of Standards and Technology (NIST), International Telecommunication Union (ITU), ISO/IEC, and industry-specific standards bodies.

Some of the most important include:

X.509 and RFC 5280

X.509 defines the widely used format for public key certificates. RFC 5280 profiles X.509 v3 certificates and X.509 v2 Certificate Revocation Lists (CRLs) for internet PKI, including certificate extensions, trust paths, revocation, and certificate path validation. It superseded earlier RFC 3280 guidance and has itself received subsequent updates.

These X.509 standards help certificates issued by different PKI systems follow a common structure, making them foundational to PKI interoperability standards.

Federal Information Processing Standard (FIPS) 186-5

NIST’s FIPS 186-5 Digital Signature Standard specifies algorithms used to generate and verify digital signatures. Digital signatures help detect unauthorized changes to data and authenticate the identity associated with a signature. FIPS 186-5 superseded FIPS 186-4 in 2023.

FIPS 140-3

FIPS 140-3 establishes security requirements for cryptographic modules. Federal programs, contracts, certificate policies, or service requirements may require the use of modules under the Cryptographic Module Validation Program at a specified security level.

NIST SP 800-57

NIST SP 800-57 Part 1 Rev. 5 provides guidance and best practices for cryptographic key management, including key protection, lifecycle functions, cryptographic algorithms, key types, backup, recovery, and other key management considerations.

Post-Quantum Cryptography (PQC) Standards

PKI standards are also evolving to address quantum threats. NIST has standardized three post-quantum cryptography algorithms: ML-KEM (FIPS 203) for quantum-resistant key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for quantum-resistant digital signatures.

To meet cryptographic standards now and in the future, organizations need the ability to identify where certificates, algorithms, and keys are deployed so they can transition to new requirements without disrupting business operations. This capability, often called crypto-agility, is becoming increasingly important as organizations prepare for post-quantum cryptography and future regulatory changes.

The U.S. Federal Public Key Infrastructure (FPKI) establishes a trust framework that supports secure digital identities and certificate-based trust across federal agencies and approved external organizations.

Federal PKI is governed through policies and technical profiles that define certificate issuance, assurance, key protection, certificate and CRL profiles, auditing, and other requirements. Federal PKI requirements are defined through applicable certificate policies, certificate and CRL profiles, annual review requirements, memoranda or agreements, and other governance documentation.

Federal agencies and organizations that need to establish or operate within a Federal PKI trust relationship should evaluate the applicable FPKI policies and assurance requirements for their use case.

Entrust also maintains documentation for its Federal PKI services, including certificate policies, certification practice statements, compliance guidance, and audit information.

PKI is commonly used to support security and compliance programs in highly regulated industries where strong authentication, encryption, and digital signatures are required. But PKI requirements vary by geography and application.

WebPKI

Publicly trusted Transport Layer Security (TLS) certificates operate within the WebPKI ecosystem and are governed by applicable browser root programs, operating-system trust requirements, and CA/Browser Forum Baseline Requirements.

These requirements define how certificates are validated, issued, managed, audited, and revoked across the public trust ecosystem. As part of ongoing efforts to improve security and reduce risks associated with long-lived certificates, the industry is adopting progressively shorter certificate lifetimes. Publicly trusted TLS certificates issued on or after March 15, 2026, are limited to 200 days, with maximum validity reduced to 100 days beginning March 15, 2027.

Shorter certificate lifetimes increase the importance of certificate discovery, lifecycle management, and automation. Organizations should prepare for continued reductions in certificate validity periods by implementing appropriate automation and governance controls to reduce operational burden and minimize the risk of outages caused by expired certificates. As certificate management requirements evolve, organizations should also periodically evaluate whether individual use cases are best served by publicly trusted certificates or by private trust models that provide greater control over certificate policies and lifecycles.

European Trust Services

European PKI and digital trust environments may also need to address eIDAS and related ETSI standards. For example, ETSI EN 319 401 establishes general policy requirements for trust service providers and supports trust services such as public key certificate issuance and electronic signatures. The standard continues to evolve alongside European cybersecurity and digital-trust requirements.

Organizations should identify the specific standards relevant to their role, jurisdiction, certificate type, and trust model rather than treating PKI compliance as a single universal checklist.

PKI Compliance Requires Continuous Governance

Organizations must not only implement standards-based PKI but also maintain visibility into certificates, keys, and cryptographic assets. Ongoing monitoring, reporting, policy enforcement, and lifecycle management help demonstrate compliance and prepare organizations for audits and regulatory reviews.

Entrust helps organizations implement, manage, and govern standards-based PKI while maintaining the visibility, control, automation, and lifecycle management needed to support evolving compliance and security requirements. These technologies can support certificate lifecycle processes, cryptographic governance, policy enforcement, and crypto-agility initiatives. Applicability and compliance depend on the deployed service, configuration, governing policy, operating procedures, and retained evidence.

• Entrust PKI solutions support certificate-based identities, encryption, digital signatures, and certificate authentication while helping organizations establish policy-driven trust models, automate certificate operations, and implement PKI according to organizational, regulatory, and industry best-practice requirements.
• Entrust Certificate Manager, part of the Entrust Cryptographic Security Platform, helps organizations discover, monitor, automate, and govern certificates across Entrust and third-party CAs. Centralized visibility and lifecycle automation help reduce operational complexity, support policy enforcement, and prepare organizations for evolving certificate requirements and shorter certificate lifetimes.
• The Entrust Cryptographic Security Platform brings PKI, hardware security modules (HSMs), cryptographic keys, certificates, and secrets under centralized visibility and policy-driven lifecycle management, helping organizations strengthen governance, support audits, improve crypto-agility, and prepare for evolving compliance requirements.
• Entrust nShield HSMs provide hardware-rooted protection for cryptographic keys and support a PKI best practice of protecting certificate authority signing keys within a validated hardware security boundary. HSMs can help organizations strengthen trust architectures and support environments requiring validated cryptographic modules, including deployments that rely on FIPS 140-3-certified protection.

Standards and compliance requirements vary by environment. Entrust technologies can help organizations implement and govern the controls required by applicable PKI policies, but technology alone does not establish compliance.

Ensure PKI compliance with trusted infrastructure solutions.

Explore PKI Options.