Building Internal PKI Infrastructure for Zero Trust: mTLS, Service Mesh, and Beyond

External SSL certificates protect your perimeter. Internal PKI protects everything behind it. In a zero-trust architecture, every service-to-service connection must be authenticated and encrypted. That requires internal PKI infrastructure at scale — issuing thousands of certificates with short lifetimes, automatically.

Why Internal PKI for Zero Trust

• Service identity — Every microservice gets a cryptographic identity, verified on every request
• mTLS everywhere — Mutual TLS between all services eliminates network-level trust
• Short-lived certificates — Minutes to hours, not months. Compromise window shrinks dramatically
• Automated issuance — No human in the loop for service certificate provisioning

Internal CA Architecture

Option 1: HashiCorp Vault PKI

Vault as an internal CA: root CA offline, intermediate CAs for each environment, automated certificate issuance via API, short-lived certificates (24h or less), policy-based issuance (which services can request which certificates).

Option 2: cert-manager + Step CA

Kubernetes-native PKI: Smallstep Certificate Authority for internal CA operations, cert-manager for automated certificate lifecycle in Kubernetes, ACME protocol for standardized issuance, integration with service mesh for transparent mTLS.

Option 3: SPIFFE/SPIRE

The CNCF standard for workload identity: platform-agnostic identity framework, automatic identity attestation based on workload metadata, short-lived SVIDs (SPIFFE Verifiable Identity Documents), federation across clusters and clouds.

Service Mesh mTLS

Service meshes (Istio, Linkerd, Cilium) provide transparent mTLS:

• Automatic certificate provisioning for every pod
• Certificate rotation without application changes
• Policy-based authorization (which services can talk to which)
• Encryption of all east-west traffic without application code changes

Compliance Value

Internal PKI provides evidence for: DORA encryption requirements, AI Act cybersecurity controls, GDPR data protection in transit, and NIS2 security measures. The infrastructure generates compliance evidence automatically — every mTLS connection is a documented security control.