About CoreEncryption
Specialist. Vendor-neutral. Documentation-obsessed.
CoreEncryption exists for the part of enterprise security that is invisible when it works and foundational when it fails: certificate authorities, private keys and the systems that depend on them.
Get in touchThe practice
Depth before breadth.
Engagements are shaped for infrastructure and security teams that need defensible decisions: what to change now, what can wait, what not to buy and how to prove the resulting control still works.
The work is finished when your team can explain it, operate it and recover it.
Operating principles
No theatre. No unexplained recommendations.
Specialist
PKI is the core discipline, not one capability in a broad security catalogue.
Vendor-neutral
Recommendations are based on the estate and the evidence, not a reseller target.
Documentation-obsessed
Runbooks, ceremony scripts and verification steps are part of the engineering — not an appendix written afterwards.
Calm under pressure
Incidents are handled by narrowing the failure path, preserving evidence and changing only what the recovery requires.
Working surface
Named capability, open for inspection.
Microsoft ADCS
- ["Offline root CA","Issuing CA tier","Certificate templates","Enrolment permissions","AIA / CDP","OCSP responders","NDES / SCEP","Autoenrolment","CA migration \u0026 upgrade","CP / CPS"]
HSM & key custody
- ["Key ceremony","Quorum design, M of N","Partition administration","CSP / KSP integration","Software-to-hardware key migration","Backup \u0026 restore","Recovery rehearsal","Network and cloud HSM"]
Certificate-based access
- ["802.1X","EAP-TLS","NPS","Windows Hello for Business","Smart cards","Intune SCEP \u0026 PKCS","ACME","Code signing"]
How we handle your access
- ["Read-only access preferred and sufficient for assessment","NDA by default, signed before evidence collection","Evidence encrypted at rest, deleted on a stated retention schedule","Collection scripts supplied for review before they are run"]
Independent by design
- ["No CLM or HSM reseller quota","Tooling recommended only where the evidence justifies it","Procedures and verification scripts handed over to your engineers"]
The capability list above describes working familiarity. No partnership or endorsement is implied.
Credentials and assurance
Verify every claim.
This site publishes only current, independently verifiable certifications and practitioner credentials. No placeholder badge or partnership is presented as evidence.