PKI security logo™PKI & Payment SecurityArchitecting Trust. Automating Security. Delivering Results.
DigiCert Trust Lifecycle Manager & Thales payShield HSM consulting

Certificates automated.
Keys protected.
Trust delivered.

Hands-on DigiCert Trust Lifecycle Manager implementations and Thales payShield HSM consulting—from integration and deployment to secure key operations.

Book a DigiCert Project Consultation ↗Explore implementation services →
● MUNICH, GERMANYEUROPE & US ENGAGEMENTS
IMPLEMENTATION EXPERTISEEP / 01
01 / CERTIFICATE LIFECYCLE

DigiCert Trust Lifecycle Manager

Discovery → Enrollment → Deployment

CA integrationsEndpoint automationValidation
02 / PAYMENT CRYPTOGRAPHY

Thales payShield HSM

Migration · Key management · Ceremonies

TR-31 / TR-34DUKPTDual control
ARCHITECTURE / DELIVERY / OPERATIONS
DIGICERT Trust Lifecycle Manager IMPLEMENTATIONCERTIFICATE AUTOMATIONThales payShield HSMPAYMENT KEY MANAGEMENT
01 / What I do

From trust architecture
to everyday operations.

01 / PRIMARY SERVICE

DigiCert Trust Lifecycle Manager
implementation & integration

Plan and implement Trust Lifecycle Manager around your certificate estate. Configure CA integrations, discovery, enrollment workflows and deployment automation, with practical testing and operational handover.

Trust Lifecycle ManagerCertCentralMicrosoft CA connectorPrivate CA / AESAgents & sensorsAWR workflows

From issuance to the live endpoint

Windows and Linux automation, IIS, NGINX, Apache, Exchange, SQL Server and load balancer integrations. Troubleshoot CSR submission, permissions, certificate chains, post-delivery scripts and bindings. Scope depends on your environment and supported integration path.

02 / PRIMARY SERVICE

Thales payShield HSM
& payment cryptography

Support Thales payShield HSM deployments, modernization and secure key lifecycle operations. Combine HSM engineering with documented controls for payment cryptographic environments.

Thales payShield HSMKey ceremoniesTR-31 / TR-34DUKPTDual controlSplit knowledge

Secure operations, clear procedures

Migration planning and validation, key hierarchy reviews, secure key exchange and ceremony procedures. Support PCI PIN readiness through technical implementation and operational documentation.

Additional support: enterprise PKI architecture, Luna HSM and ISO 27001-aligned security governance.

02 / The person behind the work

Architecting Trust. Automating Security. Delivering Results.

I’m a Munich-based Information Security Manager and PKI Architect, offering independent consulting alongside my security leadership work.

My consulting focuses on DigiCert Trust Lifecycle Manager implementation and Thales payShield HSM engineering, backed by experience in enterprise security and payment cryptography. I connect architecture with implementation—from CA design and HSM operations to certificate deployment on Windows, Linux and application infrastructure.

I work in English and Bosnian/Croatian/Serbian. Remote consulting is available for European and US teams.

ISO & PCI standards experience
  • ISO/IEC 27001 — Information security management, ISMS implementation, internal audit programmes, control reviews and audit evidence.
  • ISO/IEC 27005 — Information security risk management, risk assessment and risk treatment.
  • PCI DSS — Payment card security requirements, security controls and assessment support.
  • PCI PIN Security — PIN and payment-key security, HSM operations, key ceremonies, dual control and split knowledge.

Practical experience supporting implementation, operational security and audit readiness in enterprise and payment environments.

PKI & HSM certifications
  • DigiCert Digital Trust Solutions Architect
  • DigiCert Trust Lifecycle Manager Technical Professional
  • DigiCert CertCentral TLS Manager Technical Professional
  • DigiCert Digital Trust Professional
  • Thales Certified Payshield Engineer
  • Luna HSM Professional Engineer — Thales
Security, risk & infrastructure certifications
  • Cisco Certified Network Associate — Cisco Networking Academy
  • CompTIA Security+ — CompTIA
  • Linux System Administrator — ITAcademy by LINKgroup
  • Certified in Cybersecurity (CC) — ISC2
  • CrowdStrike Certified Falcon Administrator — CrowdStrike
  • Cloud Venafi Security Administrator — Venafi
  • Ethical Hacker — Cisco
  • Certificate of Competence in Zero Trust (CCZT) — Cloud Security Alliance
  • Cyber Threat Management — Cisco
  • Introduction to Cybersecurity — Cisco
  • ISO/IEC 27001 Lead Implementer — PECB
  • Certified CyberDefender Level 2 (CCDL2) — CyberDefenders
  • ISO/IEC 27005 Risk Manager — PECB
Technology explained

Two foundations.
One focus on trust.

CERTIFICATES & DIGITAL IDENTITIES

Who is DigiCert?

DigiCert is a global provider of digital trust solutions, including digital certificates, public key infrastructure (PKI) and certificate lifecycle management. Its technology helps organizations verify digital identities, secure communications and automate certificate operations.

About DigiCert ↗

What is DigiCert Trust Lifecycle Manager?

DigiCert Trust Lifecycle Manager combines certificate lifecycle management with private PKI services. It centralizes certificate inventory, monitoring and policy-driven operations across supported certificate authorities and enterprise systems.

  • Discover certificates and track expiration.
  • Manage issuance, renewal and deployment through supported integrations.
  • Issue private certificates for users, devices and servers.
  • Connect certificate workflows to existing infrastructure.

The goal: reduce manual work and the risk of outages caused by expired certificates. Available capabilities depend on licensing, configuration and integration support.

DigiCert documentation ↗
PAYMENT CRYPTOGRAPHY

Who is Thales?

Thales is a global technology group active in defence, aerospace, cyber and digital technologies. Its cybersecurity portfolio helps organizations protect applications, data and identities. For cryptographic infrastructure, its Thales payShield HSM and Luna general-purpose HSMs support secure key protection and cryptographic operations.

About Thales cybersecurity ↗

Thales payShield HSM in the payment ecosystem

Thales payShield HSM is a payment Hardware Security Module (HSM). It protects cryptographic keys and performs security operations used by issuers, acquirers, processors, service providers and payment networks.

  • Support secure payment transaction processing.
  • Protect sensitive payment data.
  • Support payment credential issuance.
  • Provide cryptographic services for payment tokenization and mobile acceptance.

Payment applications invoke HSM services within their processing environment. Secure integration and key management procedures help establish trust between payment participants.

Thales payShield HSM overview ↗
03 / Completed implementations

DigiCert Trust Lifecycle Manager.
Implemented across platforms.

Completed implementation projects covering certificate automation, enrollment, application delivery and network infrastructure.

✓ COMPLETED

DigiCert Autoenrollment Server High Availability

DigiCert Autoenrollment Server

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Barracuda WAF

Web application firewall

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Cerberus SFTP

Agent + AWR post-delivery script

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Cisco Firepower

Network security

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Citrix NetScaler

Application delivery controller

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Domain Controller Automation

Windows infrastructure

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Microsoft Exchange Server Automation

Messaging infrastructure

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Kemp Load Balancer

Application delivery

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

MSSQL Server Automation

Database infrastructure

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

NGINX Linux Automation

Linux web infrastructure

DIGICERT TRUST LIFECYCLE MANAGER
✓ COMPLETED

Microsoft Radius NPS & Autoenrollment

Network authentication & enrollment

DIGICERT TRUST LIFECYCLE MANAGER
Completed HSM projects

Payment cryptography.
Proven delivery.

✓ COMPLETED

Thales payShield HSM Key Migration

Migrated payment cryptographic keys from legacy HSM infrastructure to Thales payShield HSM. Delivered migration planning, HSM initialization, protected key transfer, key check value validation, payment-system integration and cutover procedures.

Delivered: Migration completed with transaction and key-management validation.

Thales payShield HSM · Key migration · Cutover planning
✓ COMPLETED

Secure Key Injection Room Design

Designed a high-security environment for remote payment key injection, combining physical access controls, monitoring, hardened workstations and documented key-handling procedures.

Delivered: Established dual-control and split-knowledge procedures supporting PCI PIN requirements.

Key injection · TR-31 / TR-34 · Security controls
✓ COMPLETED

PKI Key Migration: Luna SA → Luna 7

Reviewed the legacy PKI and HSM architecture, assessed migration compatibility, built a representative test environment and validated protected key transfer to Thales Luna 7 Network HSM.

Delivered: Completed the production migration without downtime or service disruption.

Luna SA · Luna 7 · PKI continuity
✓ COMPLETED

Enterprise Payment Key Management

Established key lifecycle governance for transaction-processing infrastructure using Thales payShield HSM. Covered payment key hierarchies, DUKPT-related keys, secure exchange and operational integration.

Delivered: Implemented key ceremony, dual-control and split-knowledge procedures with TR-31 / TR-34 key exchange.

Thales payShield HSM · DUKPT · Key ceremonies
04 / Selected experience

Specialist work.
Real infrastructure.

PAYMENT SECURITY

Payment cryptography

Enterprise key management with Thales payShield HSM: key lifecycle governance, DUKPT, TR-31 / TR-34, dual control and split knowledge.

CRYPTOGRAPHIC INFRASTRUCTURE

HSM modernization

Legacy HSM migration planning, test environments, protected key transfer and post-migration validation for PKI continuity.

CERTIFICATE-BASED IDENTITY

Enrollment & network authentication

DigiCert AES high availability, Active Directory integration and Microsoft NPS / RADIUS troubleshooting for wired and wireless certificate authentication.

Explore project details and professional recommendations on LinkedIn ↗.

05 / How we work

Clear scope.
Hands-on delivery.

01 / UNDERSTAND

Start with your environment

Review infrastructure, dependencies and constraints. Define the problem and agree on a focused scope.

02 / IMPLEMENT

Build and validate

Configure integrations, test enrollment and deployment flows, and troubleshoot issues with evidence.

03 / ENABLE

Make the handover useful

Document the configuration, operational checks and next steps so your team can support the solution.

06 / Your next project

Let's make trust
less complicated.

Planning a DigiCert Trust Lifecycle Manager implementation, certificate automation rollout or Thales payShield HSM project? Start with your environment, your goal and what is getting in the way.

Book a DigiCert Project Consultation ↗

Choose an available time for your DigiCert project discussion through Zoom Scheduler.

Connect on LinkedIn ↗

Based in Munich · Remote engagements
Part-time consulting by arrangement.

Copy this brief and send it to Emir on LinkedIn.

DigiCert Digital Trust Solutions Architect
DigiCert CertCentral TLS Manager Technical Professional
DigiCert Software Trust Manager Technical Professional
DigiCert Trust Lifecycle Manager Technical Professional
Digital Trust Professional
Digital Trust Associate
ISO/IEC 27001 Lead Implementer
Certificate of Competence in Zero Trust (CCZT)
CCNA
Cyber Threat Management
Ethical Hacker
Introduction to Cybersecurity
ISC2 Candidate
ISO/IEC 27005 Risk Manager
Certified CyberDefender Level 2 (CCDL2)
Certified in Cybersecurity (CC)
CrowdStrike Certified Falcon Administrator (CCFA)
Understanding of Cisco Network Devices
Cisco Certified Network Associate Routing and Switching (CCNA Routing and Switching)
CompTIA Security+ ce Certification
CompTIA A+ ce Certification