Insights that help security teams make better decisions.

How the ACME protocol works with a private CA: RFC 8555 flow, challenges, ACME vs EST vs SCEP vs CMP, and certbot, acme.sh and cert-manager setup with DuoKey.

Certificate lifecycle management explained: CLM stages, machine identity management, certificate discovery, preventing expiry outages and a CLM tool checklist.

How to build a cryptographic inventory: what to record, cryptographic discovery methods compared, certificate discovery, CBOM, prioritisation and a 90-day plan.

Data sovereignty in Switzerland explained: revFADP, FINMA outsourcing, the US CLOUD Act, and why key sovereignty with customer-held keys decides who reads data.

Enterprise key management explained: key lifecycle per NIST SP 800-57, KMS vs HSM vs key management as a service (KMaaS) vs MPC, and a 15-point buyer checklist.

Hold your own key (HYOK) explained: BYOK vs HYOK vs provider-managed keys, how Microsoft 365 DKE, AWS XKS and Google CSE implement it, and how to choose.

Compare Microsoft 365 Double Key Encryption providers: DuoKey, Thales, Entrust, Fortanix, Utimaco, Cosmian and IBM. Key protection, deployment, rotation, access control, jurisdiction.

ML-DSA certificates explained: FIPS 204 sizes, SLH-DSA, hybrid certificates, RFC 9881 and a migration path for a post-quantum certificate authority.

ML-KEM key management explained: FIPS 203 key sizes, ephemeral vs static keys, X25519MLKEM768 hybrid TLS, HSM storage and a PQC key management lifecycle.