Katkat
Back

Design a PKI for internal mTLS and certificates

CoupangSoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

This question evaluates a candidate's competency in PKI architecture, cryptographic key management, certificate lifecycle (issuance, renewal, revocation), and operational security for internal mTLS and related signing use cases.

System Design Prompt

Design a Public Key Infrastructure (PKI) for an organization to issue and manage certificates used for:

  • Internal mTLS between services
  • User/device certificates (optional extension)
  • Code signing or document signing (optional extension)

Requirements

  • Secure certificate issuance and renewal (automation preferred)
  • Certificate revocation (compromise/termination)
  • Strong key protection (HSM/KMS where appropriate)
  • Support multiple environments (dev/stage/prod) and possibly multiple regions
  • Auditable operations and incident response plan

Deliverables

  • CA hierarchy design (root/intermediate)
  • Issuance/renewal workflows
  • Revocation approach (CRL/OCSP) and trade-offs
  • Key management, rotation, and disaster recovery
  • Operational model (access control, auditing)