PKI & CLM
The MTG Corporate PKI combines Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM). It was specifically designed for enterprise environments to manage certificates efficiently and enable automation. This allows organizations to meet growing security requirements with greater flexibility.
MTG CLM integrates seamlessly with Microsoft PKI.
MTG Corporate PKI consists of two aligned product components of the MTG ERS ® System: MTG Certificate Lifecycle Manager and MTG Certificate Authority (MTG CARA), and thus offers protection for many use cases in companies.
The MTG Certificate Lifecycle Manager (CLM) ensures the smooth and automated management of all certificate-based processes. It improves process quality and reduces costly downtime caused by inadvertently expired certificates. In addition, the system provides a complete overview of the status and deployment locations of all certificates. Compliance policies can be implemented flexibly and are supported by detailed role- and permission-based settings.
MTG CARA is a flexible PKI platform for deploying certification authorities (CAs) and registration authorities (RAs) to issue, manage, distribute, and validate digital certificates. The platform supports multi-tenancy, crypto agility, post-quantum cryptography, and the integration of Hardware Security Modules (HSMs).
MTG CARA has been continuously developed since 2006 and has proven itself in numerous applications and trust center environments, supporting the high-performance issuance of millions of certificates. It meets all technical requirements needed to comply with demanding security standards such as BSI TR-03145 for PKI operations. The platform covers all essential PKI functions and is suitable for building and operating highly secure PKI and trust center infrastructures. It also meets the requirements of regulated or certification-critical environments.
Many organizations already use a Microsoft PKI and are looking for a suitable CLM solution to simplify certificate management. This can be easily achieved with MTG CLM
Are you using Microsoft PKI (AD CS)? Then, enhance your existing PKI with MTG’s professional Certificate Lifecycle Management.
With the MTG CA Connector, you can easily integrate MTG CLM with your existing Microsoft PKI, which continues to operate as your certification authority. At the same time, you benefit from the comprehensive features and automation capabilities of the MTG Certificate Lifecycle Manager.
Looking to replace your Microsoft PKI? With the MTG Autoenrollment Connector, you can migrate to the MTG PKI (CARA) gradually or in full while keeping your existing Active Directory processes intact.
Autoenrollment, Group Policies, and existing Windows certificate processes continue to operate as usual, while certificate issuance is handled by the MTG CARA Certificate Authority.
The MTG Corporate PKI enables the flexible implementation of a wide range of certificate-based processes and use cases – regardless of industry, infrastructure, or security architecture.
To successfully implement certificate-based use cases, three clearly defined functional building blocks work together: (1) Certificate Creation & Lifecycle Management, (2) Certificate Distribution, and (3) Certificate Usage.
Certificate Creation: The MTG PKI (CARA) operates the central Certification Authority and issues cryptographically secured digital certificates in accordance with defined policies. The MTG CLM manages the entire certificate lifecycle – from automated request and issuance to renewal or revocation.
Certificate Distribution & Usage: Certificates must be securely distributed to target systems such as servers, clients, or devices. This can be achieved, for example, through Active Directory, MDM solutions, automation protocols, or APIs. A prerequisite is that target systems – such as devices – and applications support certificates. In these environments, certificates enable authentication, encryption, and digital signatures.
With MTG Corporate PKI, you establish a powerful foundation for your security architecture. When designing the specific distribution and integration setup, we can support you as needed together with experienced consulting partners.
The MTG Corporate PKI can be deployed On-Premises within your own infrastructure. In this model, the PKI is fully integrated into your IT and security architecture. The operation and management are handled either by the internal team or by us. Processes, key management, and compliance implementation remain under the responsibilities you define.
Alternatively, the PKI can be provided entirely as a Managed PKI Service through our partner DARZ GmbH, operated in its highly secure data centers in Darmstadt and Frankfurt. Operation takes place in a professionally secured, certified environment with clearly defined responsibilities and reliable data sovereignty. The DARZ Managed PKI & CLM can be accessed in two ways: by default, a site-to-site VPN is established. Alternatively, access can be provided over the public internet, restricted to specific IP addresses.
We are happy to support you in choosing the right operating model and ensuring an efficient implementation of your PKI project – whether On-Premises or as a Managed Service.
Choosing the right operating model depends on your regulatory requirements, available resources, and the level of protection required for your data and key material. Key factors include standards such as BSI TR-03145, industry-specific security requirements, and any necessary certifications. It is also important to consider whether you have the required PKI and security expertise available internally. Ultimately, you need to decide whether you want to take responsibility for operating the PKI and obtaining the necessary certifications yourself, or opt for a professionally managed service such as the DARZ Managed PKI & CLM.
German Article on egovernment.de
Guide to Implementing a Public Key Infrastructure Solution (de)
German Article on chemietechnik.de
End-to-end encryption secures production and development (de)
German Article on automation-next.com
PKI in Industry: Security Against Cyberattacks (de)
German Article on industrieanzeiger.industrie.de
The Importance of Encryption for the Industry of the Future (de)
For further information feel free to contact us!