MicrosoftHello Ron,
If considering the PKIaaS route, what would you look for in a SaaS provider? So far, I've only come across one proposal that includes an offline root hosting service, the others all offer an online root.
MicrosoftPKI as a service trades convenience for offloading of the root hosting to a trusted provider. For example, all public certificates issued by trusted entites such as DigiCert, Sectigo, or GlobalSign roll up to a root that you don't own. You are placing your trust in that root provider to follow all possible guidance to protect their certificate authorities.
PKIaaS is no different. You are leveraging a third party to manage the root of trust to gain ease of use and accessibility through a cloud platform. While I don't have specific knowledge of their practices, I'd go out on a limb to say that every major public provider leverages an offline root with HSMs. It's been industry standard for decades.
What would I look for in a provider? Do your research and find reputable dealers. Check for major cybersecurity incidents where a public PKI was implicated. Most major vendors, including Microsoft, have robust standards that are maintained at the highest level of trust.
