Identity Management Production Safety and Compliance in Harmony

Related Vendor

FAULHABER Drive Systems

The demands on IT and OT security are rising faster than many industrial companies can operationally implement. NIS2 and CRA significantly increase the pressure. A CLM system (Certificate Lifecycle Management) is a key component for the secure and autonomous implementation of cryptographic processes and key structures.

Regulatory density is increasing: With the second Network and Information Security Directive (NIS2) and the Cyber Resilience Act (CRA), the EU is redefining what "state of the art" means in cybersecurity. For the German mechanical and plant engineering industry, this is about far more than ticking off compliance checklists. The secure identity of machines, sensors, and control units is becoming a critical factor for operational capability. In view of shortened certificate lifetimes and geopolitical risks, manufacturers need to fundamentally rethink their strategy for cryptographic keys and certificates, moving towards greater automation and European data sovereignty.

While critical infrastructure operators have long been in focus, the new NIS2 and CRA directives now bring large parts of the mechanical engineering and supplier industry into scope. This applies at least if, for example, they count companies from the food, chemical, or pharmaceutical industries among their clientele or target them. The EU's goal is to create a European legal framework that obligatorily defines how digital infrastructures and connected products are to be secured.

The current geopolitical situation also brings a crucial realization for the export nation Germany: implementing these requirements is not only about technical security but also about data sovereignty. The protection of private keys and control over cryptographic processes must remain permanently in one's own hands to prevent industrial espionage and third-party interference. A central component for this is the reliable use of a Public Key Infrastructure (PKI) in combination with efficient Certificate Lifecycle Management.

Secure Identities for the Smart Factory

PKI technologies are established as a proven standard, but their field of application is exploding in the context of Industry 4.0. Certificates no longer merely secure web servers or VPN access for employees wishing to connect to the network from outside. They represent the digital identity of every connected component: They authenticate communication between information and operational technology (OT), validate software updates for machine controls, and secure data transmission to the cloud.

With the increasing connectivity of the shop floor, the number of required certificates is growing exponentially. At the same time, the environment is changing drastically: the lifespan of public TLS certificates is currently still 398 days. However, the Certificate Authority Browser Forum (CA/B Forum) plans to gradually reduce this duration. The target is specified as 50 days.

The Risk of "Accidental Downtime"

For machine builders and manufacturing SMEs, this development is alarming. In a production hall where hundreds of sensors and controls communicate securely, manually exchanging certificates every 90 or even 50 days is hardly economically viable or error-free, increasing process risk. A single expired certificate can result in remote maintenance no longer being possible or a production line coming to a standstill because components can no longer authenticate each other.

Shorter lifetimes therefore make an automated CLM, which centrally manages both public and private certificates, such as for internal M2M communication, indispensable. The strength of a CLM lies in significantly simplifying the introduction, monitoring, and smooth operation of certificate processes. When it comes to monitoring and renewing numerous certificates, a CLM's automations demonstrate their strength. Costly downtimes due to expired certificates and the repetitive tasks of IT departments then become a thing of the past.

Structural Hurdles in Medium-Sized Businesses

For medium-sized mechanical engineering companies, building their own secure PKI, including CLM, represents a significant hurdle. There is often a lack of specialized personnel to maintain the required infrastructure in the long term. While Microsoft PKI is widespread in many companies, it often lacks native functionality for manufacturer-independent CLM, which can automatically renew certificates on non-Windows devices, as is typical in OT.

In addition, there is the aspect of independence. When Microsoft services were blocked for actors of the International Criminal Court in The Hague, it became evident how quickly dependence on US hyperscalers can become a risk. Therefore, German SMEs should, out of self-interest, ensure that cryptographic keys and identity data ideally remain under European control. The balance between data sovereignty, security, and manageable operational effort is becoming a decisive competitive factor.

Managed PKI: A Solution Approach "Made in Germany"

To resolve this dilemma, the cryptography specialist MTG AG and the infrastructure provider Darz GmbH developed a comprehensive managed PKI solution with integrated CLM, specifically tailored to the needs of SMEs. The focus is on making complex regulatory requirements such as NIS2 or CRA technically simple and data-sovereign to implement. Setting up a PKI technically is one thing; integrating it organizationally into production processes is another. The offering, therefore, includes the first managed PKI system with integrated CLM developed and hosted in Germany, which is also available as a free freemium version.

This freemium approach is strategically chosen: It allows mechanical engineers to set up test environments without financial risk, run proof-of-concepts for new machines, and gain experience in automated certificate management. Operations take place in multiple certified German data centers using Hardware Security Modules (HSM). These modules guarantee that private keys do not leave German jurisdiction. This is particularly essential for sensitive design data and production secrets and represents a deliberate countermodel to the major US platforms, aiming to establish "Made & Managed in Germany" as a trust anchor.

Future Security: Quantum Computers and Longevity

One aspect that deserves special attention in mechanical engineering is the longevity of products and machine lifetimes spanning decades. Alongside current regulations, a technological turning point is approaching with quantum computers, which will break today's encryption methods. The German Federal Office for Information Security (BSI) predicts that powerful quantum computers could become a reality as early as the 2030s. This means that data encrypted and transmitted or stored today could likely be decrypted by powerful quantum computers in the near future.

The principle "Harvest now, decrypt later" thus already threatens long-lasting capital goods and their designs. Organizations that now adopt an agile PKI solution are preparing for this future. A modern architecture enables a later switch to quantum-resistant algorithms, known as post-quantum cryptography, without needing to rebuild the entire IT landscape.

Compliance as a Quality Feature

Certificates are no longer merely an IT issue in modern mechanical engineering but the foundation for connected production and digital services. Their sovereign management determines competitiveness and compliance. European manufacturers would do well to leverage their location advantages and rely on security solutions that combine data sovereignty and automation. This turns regulatory obligations into a strategic advantage that secures long-term digital independence.