AI for PKI: How the CEMA MCP Server Enables Secure Certificate Management
The safety is in the layer, not in the prompt. Discover how AI can support certificate management while CEMA enforces permissions, approvals and auditability.
Can organisations use AI for public key infrastructure (PKI) without giving an AI assistant administrator access? The CEMA Model Context Protocol (MCP) server technology preview demonstrates a practical answer: let AI request narrowly defined operations through a controlled interface, while CEMA applies its existing role-based access and certificate workflows.
Instead of exporting an entire certificate inventory or giving a language model access to a certificate authority (CA), the assistant uses a restricted toolset. It can help identify expiring certificates, inspect certificate history and initiate authorised requests—but it cannot revoke or delete certificates through the preview tools.
1. Why direct AI access creates PKI security risks
Enterprise certificate management combines sensitive data, operational dependencies and actions with significant consequences. Revoking the wrong certificate can cause an outage. Exposing a private key can require replacement and incident response. A language model can misunderstand an instruction, and certificate fields such as subject names, Subject Alternative Names (SANs) and Certificate Signing Requests (CSRs) may contain untrusted text.
That creates four key concerns: excessive privileges, prompt injection, weak accountability and nondeterministic actions. A prompt telling an assistant “never revoke certificates” is not a technical access control. The integration must enforce that restriction independently of the model.
Key principle: AI can make PKI easier to operate, but the system, not the prompt, must decide what AI is authorised to do.
2. What is the CEMA MCP Server?
Model Context Protocol (MCP) is an open protocol that lets AI applications call named tools with structured parameters. In the CEMA technology preview, an AI assistant calls the MCP server, which communicates with CEMA through its REST API using a dedicated technical user. The model does not receive direct access to the CA, database or operating-system shell.
3. Six MCP tools and their CEMA API permissions
The documented demo exposes six functions. These are a deliberately limited subset of the available CEMA API.
API source: CEMA Certificate Manager and Registration Authority OpenAPI 2.13.0. The issuance endpoint is part of the Registration Authority API. Endpoint paths above are relative to the CEMA API base URL.
What the AI cannot do
The preview does not offer tools for approving, revoking, modifying or deleting certificates, or for exporting private keys. The restricted Certificate Issuer role is intended to exclude the corresponding sensitive privileges, including CERTIFICATE_APPROVE, CERTIFICATE_REVOKE, CERTIFICATE_MODIFY, CERTIFICATE_DELETE, SENSITIVE_DATA_ACCESS, FOREIGN_DATA_ACCESS and MULTI_DEPARTMENT_DATA_ACCESS.
4. AI with direct access vs AI through CEMA MCP
5. Certificate requests and human approval
The assistant can submit a certificate request when its CEMA role allows issuance. Only templates configured with an approval step require a certificate officer to approve the request. Other authorised requests may issue directly. This is existing CEMA functionality, not a claim that the approval sequence was demonstrated live.
Where are private keys generated?
In the documented demo, the MCP server generates the key pair in memory and submits only the CSR to CEMA. The model never sees the private key, and the demo key is not persisted. For production, the proposed approach is to generate the private key on the target system and submit only its CSR. The demo should not be presented as a production key-deployment workflow.
6. AI-powered PKI use cases demonstrated with CEMA
Find expiring certificates using natural language
An administrator can ask: “Which certificates expire in the next 30 days? Group them by CA.” The assistant searches the inventory and summarises matching certificates by issuer. The demo tenant contained approximately 150 certificates across four CAs. Because the expiry dates were fixed, the number in a rolling 30-day window changes: 36 matched on 20 October 2026, and 30 on 26 October 2026.
Identify RSA-2048 certificates for cryptographic planning
Another question is: “Which active certificates still use RSA-2048 keys?” In the documented demo, the assistant found 84 active RSA-2048 certificates. Such inventory queries can support a cryptographic migration assessment, including post-quantum planning. Finding RSA-2048 certificates does not by itself establish which systems are ready for replacement or which algorithms they should use.
Refuse unauthorised revocation requests
If a user says “Now revoke the old certificate,” the assistant cannot execute that operation through the preview toolset. It can explain that revocation requires a suitably authorised operator and recommend verifying the target certificate and deployment status first.
Revocation nuance: Revocation is generally final. Where the CA permits it, CEMA can suspend a certificate using certificateHold and release that suspension using removeFromCRL. The supplied product explanation states that publicly trusted CAs such as GlobalSign Atlas and SwissSign do not permit suspension.
7. Limitations, data protection and availability
Access controls limit what an AI assistant can do; they do not guarantee that its interpretation or summary is correct. Certificate metadata returned by tools can be passed to the model provider. Organisations must assess data residency, confidentiality and provider contracts before deployment.
The documented demo used CEMA 2.13.0+21507, a custom web chat and Claude Opus 5.5 through Anthropic’s hosted API. Testing was performed against an on-premises development instance. The MCP component is a technology preview, with demonstrations available on request, not a generally available production feature. Broader tool coverage and CEMA Cloud availability were targeted for Q1 2027 in the October 2026 product discussion; confirm roadmap status before publication.
8. What CEMA MCP means for enterprise certificate management
AI can make certificate inventory questions easier to ask and answer. For PKI teams, the more important architectural question is whether the assistant operates within the same controls as human operators. CEMA’s role-based permissions, certificate templates, tenant boundaries and audit functionality provide the foundation for the preview integration.
By exposing a limited MCP toolset, the design separates natural-language assistance from privileged certificate operations. The model can help users discover and request; CEMA determines what is permitted.
Frequently asked questions about AI for PKI and CEMA MCP
1. What is AI-powered PKI management?
AI-powered Public Key Infrastructure (PKI) management uses artificial intelligence to help organisations search, analyse and manage digital certificates more efficiently.
AI assistants can support tasks such as identifying expiring certificates, reviewing certificate inventories, analysing cryptographic algorithms and preparing certificate requests.
However, AI should operate within established security controls, including role-based access, approval workflows and audit logging.
2. What is the CEMA MCP Server?
The CEMA MCP Server is a technology preview that connects AI assistants to CEMA Certificate Lifecycle Management through the Model Context Protocol (MCP).
Instead of giving an AI model direct access to certificate authorities, databases or administrative systems, the MCP Server exposes a restricted set of tools that communicate with CEMA's REST API.
This allows organisations to explore AI-assisted certificate management while retaining CEMA's existing authentication, authorisation and auditing controls.
3. How does the CEMA MCP Server improve PKI security?
The CEMA MCP Server limits AI access through a combination of restricted tools and CEMA's existing security permissions.
Key security measures include:
- Dedicated technical user authentication.
- Role-based access and tenant restrictions.
- No exposed tools for certificate revocation or deletion.
- Existing certificate approval workflows.
- Audit logging of actions performed through CEMA.
- No private key exposure to the AI model in the demonstrated implementation.
These controls help reduce the potential impact of incorrect AI decisions or prompt injection attacks.
4. Can AI revoke or delete certificates through the CEMA MCP Server?
No. The current CEMA MCP technology preview does not provide tools for revoking or deleting certificates.
Additionally, the restricted technical user does not have the CERTIFICATE_REVOKE or CERTIFICATE_DELETE privileges.
This provides two layers of protection: the AI cannot request these operations through its available tools, and CEMA would reject unauthorised operations.
5. Does CEMA MCP support certificate approval workflows?
Yes. Certificate requests submitted through the CEMA MCP Server remain subject to CEMA's existing certificate issuance and approval policies.
If a certificate template requires approval, the request remains pending until an authorised certificate officer approves it.
Templates without an approval requirement can issue certificates directly, provided the requesting technical user has the necessary permissions.
The approval process is an existing CEMA capability, rather than a separate approval mechanism introduced by MCP.
6. Are private keys exposed to the AI model?
No private keys are exposed to the AI model in the demonstrated CEMA MCP implementation.
In the technology preview, the MCP Server generates a key pair in memory and submits only the Certificate Signing Request (CSR) to CEMA. The private key is not stored.
For production architectures, the intended approach is to generate private keys on the target system and submit only the CSR for certificate issuance.
Organisations should evaluate key generation and storage requirements before deploying AI-assisted certificate workflows.
7. Can the CEMA MCP Server help identify expiring certificates and prepare for post-quantum cryptography?
Yes. The technology preview demonstrates how AI can query certificate inventories and help administrators identify certificates requiring attention.
For example, administrators can ask which certificates expire within the next 30 days or which active certificates still use RSA-2048 keys.
This can support certificate renewal planning, cryptographic inventory assessments and preparation for post-quantum cryptography migration.
The AI provides analysis based on the certificate information it is authorised to retrieve. Its results should still be reviewed by qualified PKI administrators.
8. Is the CEMA MCP Server available for enterprise deployment?
The CEMA MCP Server is currently presented as a technology preview, with demonstrations available on request.
The demonstrated implementation has been tested against CEMA 2.13.0 in an on-premises development environment, using Claude Opus 5.5 through the Anthropic API.
Broader tool coverage and CEMA Cloud availability were targeted for Q1 2027 in the product team's October 2026 roadmap, but these plans should be confirmed before publication.
Organisations interested in exploring AI-assisted certificate management can contact ID-Security to discuss the technology preview and potential use cases.
Technical references and editorial notes
Sources: CEMA MCP technology-preview draft and product-owner clarifications dated October 2026; CEMA Certificate Manager OpenAPI 2.13.0; CEMA Registration Authority OpenAPI 2.13.0. Before publishing, confirm current roadmap, demonstration availability, final product-page URL and contact URL. Demo metrics are dated rather than presented as current live inventory counts.
