Certificates, one-time passcodes and licences for a security vendor

Situation

A company selling authentication products has an awkward property: the systems it runs internally have to be at least as trustworthy as the things it sells. Three of those systems needed building or replacing.

Cryptographic material was being issued by hand. Certificates and key pairs were generated ad hoc, with parameters retyped each time and the record of who issued what living in people's memories and shell history — which is exactly the situation an auditor asks about first.

One-time passcodes had to reach phones in dozens of countries, where the sensible route to a handset differs by destination and changes over time.

And commercially, nobody had one answer to "what is this customer entitled to" — which products, which editions, on which hardware, under which contract.

What I built

A key and certificate service. Operators generate key pairs, certificate requests and certificates through a web interface, or machines do it through a REST API. Certificate authorities are first-class, and reusable profiles carry the parameter sets so the common cases are a choice rather than a form to retype — which removes the category of mistake where a certificate is issued with subtly wrong usage flags. Keys live in addressable slots. Every operation is recorded in an audit trail intended to be read by someone sceptical.

A passcode delivery gateway. Accounts submit messages through an API and the gateway decides how to deliver each one: routing tables select a channel per destination country, so a change of carrier is configuration rather than a deployment. Delivery is tracked per message, and every request is logged in a form that can be reconciled afterwards — because when a customer says "the code never arrived", the answer has to be evidence rather than a guess.

The commercial record. Customers, contracts, and the product editions and add-ons each contract covers, along with the physical appliances shipped against it and the returns process when hardware comes back. Partners and resellers sit in the same model, and customers see their own entitlements through a self-service portal instead of asking someone.

Outcome

Key issuance became an audited, repeatable operation rather than an expert activity. Passcode routing became something operations could change without a release. And "what is this customer entitled to" got a single answer.

The through-line is unglamorous: all three replaced knowledge that lived in particular people with a system that states it explicitly and records what it did. That is most of what this kind of work actually is.