This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Implementation guide · In review

Certificate Lifecycle on CyberArk Certificate Manager

An implementation guide: building Book 07’s certificate lifecycle on CyberArk Certificate Manager, Self-Hosted, from platform build to the six migration waves

Research under review: a narrated implementation guide for running Book 07’s certificate lifecycle management on CyberArk Certificate Manager, Self-Hosted: what the platform is made of, platform build, FIPS posture, issuer integrations, Intune coexistence, discovery and ownership, enrollment automation, and the migration waves.

Modified

October 23, 2026

Status — In review

This page is under review and is not yet part of the workbook's production guidance. Its claims are sourced, but its analysis and any recommendation are the program's working view; they may change before review is complete, and they are not endorsed by any federal agency. Last reviewed 2026-11-05.

Book 07 — PKI & Certificates sets the certificate architecture: Microsoft Cloud PKI through Intune for managed devices, a hardened AD CS retained for servers and domain controllers, the Federal PKI for PIV, public CAs for internet-facing names, and one certificate lifecycle management (CLM) platform as the system of record for everything Intune and the PIV system don’t manage. This implementation guide builds that CLM layer on CyberArk Certificate Manager, the program’s choice because CyberArk is the agency’s existing machine-identity vendor and the program doesn’t add a second CLM vendor.

Watch or download

Research: Certificate Lifecycle on CyberArk Certificate Manager — implementation guide · 20 minutes · captions from the player's CC button · Download MP4 · All videos

Jump to a slide (34)

Edition	File
Deck	Research_CyberArk_CLM.pptx
Narrated, self-running (about 20 minutes, captions)	Research_CyberArk_CLM_Narrated.pptx
Narration script and caption track	Script · Captions

What it covers

Part	Content
Orientation	Book 07’s issuer map and the CLM’s role, and what “the platform” means; prerequisites and decisions: the self-hosted edition (no FedRAMP package exists for the SaaS edition), version 26.1, Windows Server and SQL Server requirements
Inside the platform	What the platform is made of: its server roles, the web tier, the back end (processing engines, log servers, the Message Bus), the components switched on per server, drivers, agents, the database and keys, what it connects to, a two-site reference topology, and one certificate’s journey through it
1. Build the platform	Architecture and high availability; FIPS posture, and what can’t be claimed; console sign-in through Entra single sign-on with certificate-based authentication (design guidance); hardening and least-privilege service accounts; backup and recovery of the database and keys
2. Connect the issuers	The AD CS driver, its permissions and scoping the CA account under ESC7; public and cloud CA drivers in 26.1 (the Entrust driver is gone); Intune coexistence: Intune keeps device certificates, and the CLM’s own SCEP-CA option is documented but rejected as a second issuer
3. Discover, own and automate	Discovery scans and CA import; ownership through policy folders tied to identity and CMDB owners; enrollment automation (ACME, EST, SCEP, REST, agents); Kubernetes through cert-manager inside the boundary; ServiceNow (only a third-party Store app) and SIEM
4. Migrate and operate	The build mapped to Book 07’s six waves (design guidance); renewal as public TLS lifetimes shrink; monitoring and drift; decommissioning AD CS with the CLM inventory; decisions, vendor asks and next steps

The backup section holds an assessor’s evidence checklist, a risks register, what couldn’t be verified or sits behind a login, and the full source list.

Inside the platform

“The platform” in this guide is CyberArk Certificate Manager, Self-Hosted: a cluster of Windows servers running the same software against one SQL Server database, with a role for each server set by the components switched on. Book 07, Appendix C — Anatomy of the CLM Platform describes each component, with notes to CyberArk’s 26.1 documentation; the deck’s “Inside the platform” section walks through the same four diagrams.

Server roles of CyberArk Certificate Manager: a load balancer in front of web services servers and separate ACME servers not in FIPS mode; back-end processing servers and log and event servers; all linked by the Message Bus, MQTT over TLS on 8883 between every server, to one SQL Server Always On database and an HSM pair. Book 07 Appendix C describes the figure in full. — The platform’s server roles: web services and separate non-FIPS ACME servers behind a load balancer, back-end and log servers, the Message Bus, one SQL Server Always On database and an HSM pair.

Integrations of CyberArk Certificate Manager: AD CS, public CAs and AWS as issuers; Windows IIS and CAPI, appliances, keystores, cloud stores and Kubernetes as installation targets; Entra ID for sign-in, the CyberArk vault for driver credentials, ACME, EST, SCEP and REST clients, the SIEM over syslog-TLS and ServiceNow through a third-party app. Book 07 Appendix C describes the figure in full. — What the platform connects to: issuers, installation targets, Entra ID, the CyberArk vault, enrollment clients, the SIEM and ServiceNow.

A two-site layout: each site has a web services server, a non-FIPS ACME server, a back-end server and a log server behind shared load-balancer names, a Message Bus mesh between all eight servers, one SQL Server Always On availability group across the sites and an HSM pair. Book 07 Appendix C describes the figure in full. — A two-site reference topology (program design guidance).

Discover, place and own, enroll, provision, validate and monitor, renew back to enrollment before expiry, and revoke or retire when no longer needed; every step is logged. Book 07 Appendix C describes the figure in full. — One certificate’s journey through the platform.

What the research changed in Book 07

The research behind this guide corrected three points in Book 07, now updated:

ACME and FIPS (Chapter 08): CyberArk’s 26.1 installation guide says FIPS mode isn’t supported for its ACME service at all, not only for the win-acme client, so the ACME service runs on dedicated servers outside the FIPS-mode server set.
Cloud PKI inventory (Chapter 04): CyberArk documents no Cloud PKI import; reporting those certificates in the CLM needs a custom job from a Microsoft Graph beta report.
Scoping the CLM’s CA account (Chapter 05): Microsoft publishes no Windows Server 2025 procedure for certificate-manager restrictions, so the scoping rests on template permissions plus tested allowed and denied requests.

Status and review

In review. Every claim was checked against CyberArk’s 26.1 documentation, Microsoft Learn, AWS documentation, the ServiceNow Store, the NIST CMVP list and FedRAMP Marketplace data on October 22, 2026. Open items, including Windows Server 2025 CA support in the vendor’s integrations table, Azure Government support for the Key Vault driver, which cryptographic module the product uses, and console sign-in with PIV, are listed as vendor asks in the deck. To move this guide to Proved, build it in a lab or pilot boundary and record the evidence on this page. Comments and corrections are welcome as issues on GitHub.

Related: Book 07 — PKI & Certificates, the Book 07 technical deep dive, and the research explainer Who Names the Device After AD?, which covers the DNS names certificates carry.

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this guide, newest first
Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Review gate ignores the edition tag in deck links; four decks build again (#363)
1.3	2026.11.4	2026-11-05	Approve ten pages on Mike’s word, and drop two names from the briefs (#360)
1.2	2026.11.3	2026-11-05	Review gate: Mike’s approval of the 15 implementation guides gated on November 3 (#348)
1.1	2026.11.1	2026-11-01	Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282)
1.0	2026.11	2026-11-01	Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269)