PKI Engineer

What Updating PKI certificates means

They want someone who can:

• Renew certificates before they expire.
• Replace expiring or compromised certificates on network devices.
• Generate CSRs (Certificate Signing Requests) and work with internal or external Certificate Authorities (CAs).
• Install certificates on network equipment (routers, switches, firewalls, load balancers, VPN appliances, proxies, wireless controllers, etc.).
• Validate certificate chains (root ? intermediate ? leaf).
• Update trust stores on network devices.
• Troubleshoot certificate-related outages like:
• VPN authentication failures
• TLS handshake issues
• Certificate mismatch or wrong key pairs
• Expired or revoked certificates

Examples of network devices needing PKI updates

A network engineer may need to update certs on:

• Cisco ASA/Firepower
• Cisco ISE
• Palo Alto firewalls
• F5 load balancers
• NetScaler/ADC
• VPN gateways
• SD-WAN appliances
• Wireless controllers (for EAP-TLS)
• Web proxies

Why customers care

Expired or misconfigured certificates can cause:

• VPN login failures
• Admin portals becoming unreachable
• Network authentication breaking (802.1X, Radius)
• Encrypted traffic (TLS/SSL) not functioning
• So, they want someone who can prevent outages and manage the lifecycle of certificates.

Required skill set

When a customer asks for this, they usually expect:

• Knowledge of PKI fundamentals (RSA, ECC, CSR, CRL, OCSP)
• Experience with certificate authorities (Microsoft ADCS, Entrust, DigiCert, GlobalSign, etc.)
• Experience applying certificates on security/network platforms
• Ability to script or automate renewal workflows (PowerShell, Python, Ansible)