PKI Architecture & Design
End-to-end design of a production-grade PKI hierarchy: trust anchor, CA policies, HSM integration, CP/CPS drafting.
→ Architecture doc, HSM sizing, CP/CPS draft
✦ CISSP Certified 6+ Years PKI Engineering 📍 Brussels, Belgium
Your certificates.
Secured. Automated.
Compliant by design.
Brussels-based PKI boutique helping banks, financial institutions, and smart-city operators design, deploy, and automate enterprise PKI — fully aligned with DORA, NIS2, and eIDAS 2.0.
Available for engagements · Q2 2026
Why this matters now
Regulators stopped looking away.
PKI is invisible — until it isn't. Expired certificates take down production. Misconfigured CAs fail audits. Four forces are converging.
DORA
Operational resilience, now enforceable
Cryptographic controls are an explicit pillar of DORA. Register, audit, remediate — on schedule.
NIS2
Expanded scope, personal liability
Boards can be personally liable. PKI hygiene is no longer an IT back-office concern.
eIDAS 2.0
QWACs, QSealCs, and wallets
New qualified trust services require conformance against ETSI EN 319-series norms.
Post-Quantum
A two-decade migration has begun
Crypto-agility is the new hygiene. Inventory, prioritise, and pilot ML-KEM / ML-DSA early.
Services
Six engagement types. Senior-only delivery.
Scoped, fixed-price where we can — time & materials where scope genuinely moves. No junior account manager between you and the work.
DORA Gap Assessment
Structured review of cryptographic controls against DORA ICT risk requirements. Register, map, remediate.
→ Gap register + remediation roadmap
EJBCA / ADCS Deployment
Hands-on installation and hardening — Enterprise Java Beans CA, Microsoft ADCS, HashiCorp Vault.
→ Running, hardened, documented PKI
Certificate Lifecycle Automation
ACME, EST, SCEP, cert-manager, Venafi integration. No more expired certs taking down production.
→ Automated issuance + renewal pipeline
PKI Incident Response
Private-key compromise, CA migration, revocation storms — 24h senior on-call during the bleed.
→ Contained incident + post-mortem
Technical Training
On-site or remote workshops for your engineering, ops, and compliance teams. No slides — live labs.
→ Certified, confident PKI operators
IZ
Ismail Zemouri, CISSP
About
Senior expertise. Zero juniors. No fluff.
MYKEYPAIR is led by Ismail Zemouri, CISSP — 6+ years of hands-on PKI engineering across EU banks, financial market infrastructure, and critical utilities. Previous engagements with leading EU banks, a major central bank, critical infrastructure operators, and a global automotive group.
Vendor-agnostic. EJBCA, Microsoft ADCS, HashiCorp Vault, enterprise HSMs, AWS CloudHSM — the tool follows the architecture, not the other way around.
CISSP ETSI EN 319 EJBCA PKI CA HSM integration
Pricing
Three ways to work with us.
All prices exclude 21% VAT. EU reverse charge applies for B2B outside Belgium.
Discovery
Free · 30 min
Scoping call. Senior-to-senior. No sales deck.
- Your PKI estate, reviewed
- Regulatory exposure
- Proposal within 48 h
Most popular
Fixed Engagement
€18,000 · from
Architecture, gap assessment, or deployment — scoped, fixed.
- Scoped SOW
- Defined deliverable
- CISSP-led, senior-only
- Written report + handover
Retainer
€12,500 / month
Senior PKI on-call for your team. Cap 10 days/month.
- Named senior engineer
- 10 day/month cap
- 24 h response SLA
- Quarterly review
Ready to start?
Let's talk about your PKI estate.
30-minute discovery call — senior-to-senior. No sales deck, no demos, no junior account manager.
✓ Thanks. We'll reply within 48 hours — from Brussels.