Public Key Infrastructure Experts
to secure identities, certificates and encrypted systems with fast, precise AI matchingHire experts who design certificate authorities, automate X.509 certificate lifecycles and integrate mutual TLS across enterprise systems. FRATCH connects you with vetted, available freelancers whose skills match your PKI requirements quickly and precisely.
Meet FRATCH Experts who have recently used Public Key Infrastructure
Matthias S.
Last position:
Project Coordinator, Transport and Handover of Deployable Data Centers at BWI GmbH
- Security Clearance 2 (SÜ2) verified
- Reported to the GMN Serie1 TP subprogram management
- Ensured the handover of around 300 deployable data center containers to the Bw customer in accordance with contractually defined military requirements
- Ensured transport and acceptance by Bw
- Ensured staff training
- Prepared decision papers (e.g., project plans, governance models, communication plans, controlling models, roles and responsibilities matrices)
- Analyzed existing processes, identified areas for improvement, and designed solutions to increase their efficiency and effectiveness
- Responsible for project governance through reporting and resource planning in the subprogram using Jira, PM Pulse, KeyPIA (MicroStrategy)
- Developed the project methodology using agile methods
- Handled customer requirements (Requirements Engineering)
- Prepared for and supported contract negotiations for “System Maintenance 2027+” (7-year term, 500+ Mio budget)
Mohammed N.
Last position:
IT System Manager at Corporate Network Solution Provider
- Architected, Deployed and Supported hosted email solutions in Linux and Windows environments with enterprise-grade anti-spam and security architecture for service-provider environments.
- Managed Microsoft Azure environments including Virtual Machines, VNets, Storage, VPN, and Firewall configuration.
- Administered Microsoft Exchange Server (2010-2019), Microsoft Exchange Server SE, Active Directory, PKI, Hyper-V and Zimbra environments with disaster recovery planning and operational support.
- Led Microsoft 365 onboarding and migration projects from Exchange, IMAP, and Zimbra platforms to Microsoft 365.
- Prepare security and compliance to support Microsoft 365 Copilot.
- Implement information protection and data loss prevention by using Microsoft Purview.
- Implement retention, eDiscovery, and communication compliance in Microsoft Purview.
- Integrated Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS).
- Delivered secure hybrid infrastructure solutions integrating Microsoft Windows Server and Linux-based enterprise environments.
- Supported enterprise integration projects involving Debian, Ubuntu, CentOS, Red Hat, Barracuda ESG, Qmail and Zimbra Platforms.
Dirk W.
Last position:
Senior Consultant, CX, C-Sat, Customer Value Management at ojuto GmbH
Customer Service Reorganization at DCS Digital Charging Solutions, Munich
Management of nearshore service providers
Implementation of scorecard, Q-management and CSAT management definition, customer loyalty
Customer Service Reorganization Strategy at TWS Total Webhosting Solutions Group, Amsterdam
Brand consolidation
Webhosting mass market customer service strategy
Q-management and CSAT management definition, upselling
Provider Strategy Nearshore Customer Service, RFP process at Advanzia Bank, Luxembourg
Definition of upsell campaigns for business customers from ISDN to NGN (VOIP) at 1&1 Versatel GmbH
Customer approach, switching terms, order entry, service delivery, end-to-end processes, customer communication
Definition of customer service processes (telecom, mass market, use cases) at E.ON Broadband, Avacon Connect GmbH, Berlin and Sarstedt
Order entry, field sales processes, commission settlement, requirements for the CRM system (MS Dynamics), service provider management
Definition of statement of work for phone and written contacts (skill definition, forecast process, SL measurement, quality measurement, scorecard, bonus-malus) at Lechwerke, LEW, Augsburg
Support of tender process for service provider selection
Robert K.
Last position:
Interim Manager | Group Manager in the IT Operations & Digitalization division „Databases, Operations & Support" (DOS) at Landwirtschaftliche RentenBank
- Functional management and further development of a team of 28 IT employees (internal & external) in the areas of HelpDesk / HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basic operations
- Management of external service providers (including FI-TS for SAP basic operations)
- Personnel, resource and budget planning for the IT department and projects
- Introduction and establishment of regular communication formats (regular meetings, team and cross-departmental meetings)
- Ensuring application operations in a hybrid environment (Windows / Linux with database and web/application servers)
- Support for transformation projects to modernize the application landscape (e.g. DevOps approaches)
- Building and introducing digital IT procurement for hardware & software (e.g. with DELL)
- Development and management of the „IT Operations DOS" department based on the company strategy
- Preparation of management reports & decision papers on IT projects, optimization potential and automation opportunities
- Representing the department in Rentenbank committees and ensuring regulatory compliance (BaFin §44, DSGVO, BSI, MaRisk)
Mario B.
Last position:
Project Lead & Consultant DMARC/Email Authentication, Exchange at Comedia. IT GmbH
Goal:
Protect customer domains from spoofing by establishing and securing DMARC compliance, and ensure secure and stable operation of the Exchange and Microsoft 365 environment while keeping legitimate mail flows running smoothly.
Responsibilities:
- Project management, including reporting, customer coordination and budget responsibility
- Set up and secure DMARC, including DKIM and SPF
- Ongoing analysis of DMARC reports to detect and resolve issues early
- Replace EWS connections before Microsoft's shutdown on 01.10.2026 by switching to Microsoft Graph
- Introduce sensitivity labels in Microsoft Purview to protect sensitive information
- Automate recurring administrative tasks with PowerShell
- 3rd Level Support and ongoing administration of Exchange Online and Exchange on-premises
Technologies: Exchange Online, Exchange Server (on-premises), Microsoft 365, Microsoft Graph API, EWS, Microsoft Purview / Sensitivity Labels, DMARC, DKIM, SPF, RUA-Reporting, PowerShell, HCL Notes
Michael S.
Last position:
Senior System Engineer at VCS Value Chain Solutions GmbH
Planning and updating the entire environment to Windows Server 2022 and 2025
- Hardening of DCs and servers, setup of event log forwarding
- Migration of all existing Windows 2019 servers (including Active Directory DCs, DNS and CA) to Windows Server 2022 and 2025
- Automation of security patches for the Hyper-V clusters via PowerShell (CAU)
- Network administration
- Continuous operation and support of the MS Hyper-V environments
Christian F.
Last position:
Architecture Management at Agency
Expert in the company's architecture management area
Support for standardizing the company's IT landscape
Further development of architecture management
Shaping the company's business architecture
Restructuring, administration and maintenance of all IT assets
Support in creating a unified software asset management and CMDB
Creation of unified document management (e-file)
Transition of documents into a central DMS structure
Link between architecture management and the department's internal business process management
Support in developing strategic and tactical development plans
Organizing communication with key stakeholders
Support in the conception, organization and coordination of the architecture office to be built up
Accompanying and advising the entire architecture management process
Advising the company's business units on architectural topics and their framework conditions
MS Office, Windows 10, VBA
ITIL, TOGAF, PowerBi, Kanban, Scrum
Internal agency tools
Open Touch Conversation, Webex, wire, bdbos
MS Sharepoint, JIRA, Confluence
ARIS, Archimate, BPMN
Jens R.
Last position:
Platform Architect & Senior Developer at Direct client, industrial measurement technology, medium-sized company
- Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
- Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
- Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
- Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
- Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
- Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.
Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin
Toralf C.
Last position:
IT Consultant in PKI Software Development at BWI
- Implementation of a full-stack application with Angular as frontend framework and Java as backend language
- Use of the Swagger OpenAPI specification for REST communication between frontend and backend applications
- Control of a card printer via the Nexus Card SDK framework
- Design and implementation of card management software with web interface and JavaFX module for printer monitoring
- Use of Cucumber tests for test automation and creation of test artifacts for testing outside the development environment
- Use of Wireshark for network investigations to analyze the API of a third-party product and to check the REST API of the self-developed software
Ales L.
Last position:
Senior DevOps Consultant (Freelance) at European Union Agency (via IBM)
- Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
- Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
- Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
- Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
- Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
- Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
- Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
- Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
- Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
- Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.
Tobias R.
Last position:
M&A IT Project Manager / Cross-functional Technical and Integration Manager at Sandoz AG
- Worked for several M&A projects (Eire, Sunshine C, Coral) in the role of IT project manager and cross-functional technical manager / integration manager.
- Preparation and maintenance of project charters, project change requests and project plans.
- Weekly project status report.
- Preparation of decision papers and steering committee slidedecks.
- Risk & issue management.
- Tracking and managing activities, dependencies and deliverables across all functional IT domains.
- Data migration (planning and execution).
Will O.
Last position:
Solution Architect at Polizei Behörde Stuttgart
Designed a migration strategy for WLS applications to BKA Cloud and Stack IT
Created a hybrid cloud for internal testing and development with Kubernetes
Transformed the IT landscape from an outdated monolithic architecture to a cloud-based architecture
Integrated new CI/CD processes using Azure Pipelines
Quadrupled the processing throughput for personnel security checks
Migrated personnel security screening applications to Docker-based applications
Implemented CI/deployment pipelines using Azure DevOps
Environment: Java Springboot, Kubernetes, Oracle Weblogic, OpenID, Camunda, JUnit, TOGAF
Felix O.
Last position:
Cloud Engineer at GUS Group
Cloud Journey Kickoff on STACKIT
- Helped the client kickstart their cloud journey on sovereign EU STACKIT platform.
- Bootstrapped IAC & GitOps architecture with Opentofu and ArgoCD.
- Setup platform fundamentals for a fresh, holistic cloud experience: Kubernetes, external secrets, certificate management, gateway API, DNS & routing, observability basics.
Mohamad D.
Last position:
DevOps Engineer & IT-Security-Architect at BMW Group
- Built Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
- Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
- Hardened CI/CD pipelines with Jenkins, SonarQube, Fortify SSC, and Contrast AST
- Integrated SAP BTP/Kyma and ServiceNow GRC
Stefan A.
Last position:
Sole Architect and Developer at Bauernhof-Eis Stangl GbR
Design and implementation of a compact ERP, CRM, accounting, and production-planning platform for a German food manufacturer. The system replaces Rechnung11, self-built Excel sheets, and manual processes for fewer than 10 internal users.
- Designed and implemented the full platform architecture as sole architect and developer.
- Built modules for customer management, B2B order handling, invoicing, production planning, and accounting support.
- Implemented DATEV export, ZUGFeRD/XRechnung e-invoicing, FinTS bank statement synchronization, and GoBD audit trail concepts.
- Used AI-supported workflows for prototyping, test support, and implementation acceleration while retaining full architecture, review, testing strategy, and technical ownership.
Technology: Java 23, Spring Boot 3, Spring Data JPA, Spring Security, Vue 3, TypeScript, PostgreSQL, Flyway, REST, OpenAPI, JWT, TOTP, RBAC, DATEV, FinTS, ZUGFeRD, XRechnung, GoBD, JUnit, Mockito, Testcontainers, Playwright, Docker, GitLab CI/CD
Discover over 15,000 top freelancers
Statistics of experts using Public Key Infrastructure
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
1.7 years
Positions per freelancer
18
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Manufacturing, Banking and Finance
Certification focus areas
Information Technology, Project Management, Product Development
Bachelor's degree or higher
75%
Master's degree or higher
50%
Doctorate
10%
Certifications per freelancer
6
Most common languages
German, English, French
Speak two or more languages
99%
Based on our profile pool as of 5 Nov 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts using Public Key Infrastructure
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 5 Nov 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Public Key Infrastructure experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (97%)
- Manufacturing (57%)
- Banking and Finance (56%)
- Automotive (53%)
- Government and Administration (52%)
- Telecommunication (49%)
- Healthcare (47%)
- Transportation (41%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Digital trust
Public Key Infrastructure, commonly called PKI, is the framework for creating, issuing, validating, renewing and revoking digital certificates. It binds public keys to verified identities so systems can authenticate users, devices, services and organisations. PKI supports encryption, digital signatures and trusted communication across networks.
Core components
A PKI environment usually includes a root certificate authority, issuing certificate authorities, registration processes, certificate policies and revocation services. X.509 certificates carry identities and public keys, while certificate stores and trust stores determine which issuers a system accepts. Strong designs protect private keys with hardware security modules or carefully controlled key management services.
Where PKI runs
PKI appears in infrastructure where identity and encrypted communication must be controlled consistently:
- Mutual TLS between services, APIs and internal applications
- Secure Wi-Fi, VPN and network access using device certificates
- Smart cards, signing systems and document authentication
- Device identity for connected products and industrial systems
- Email encryption and enterprise certificate-based access
Tools and integration
Professionals work with OpenSSL, Microsoft Active Directory Certificate Services, HashiCorp Vault, Venafi, Keyfactor and cloud certificate services. They connect PKI with Active Directory, IAM systems, Kubernetes, service meshes, load balancers and endpoint management. Automation commonly uses ACME, APIs, infrastructure as code and policy-based renewal workflows.
When specialists help
Companies bring in freelance PKI specialists during certificate authority migrations, cloud adoption, compliance programmes and security architecture changes. They also help when certificates expire unexpectedly, trust chains are inconsistent or manual renewal creates operational risk. Useful deliverables include a certificate inventory, lifecycle policies, migration plans, operating procedures and tested recovery processes.
What strong professionals deliver
Strong PKI professionals understand cryptography without losing sight of operations. They document trust models, separate root and issuing authority functions, limit private-key exposure and design clear ownership for every certificate. They test revocation, renewal, backup and disaster recovery, then explain the model in language that security, infrastructure and application teams can use.
Frequently asked questions
The facts hiring teams ask for most often when it comes to Public Key Infrastructure.
Public Key Infrastructure is used to establish digital trust between people, devices, applications and services. It supports certificate-based authentication, encryption, digital signatures and mutual TLS, helping organisations verify identities and protect data in transit.
PKI uses asymmetric cryptography and certificates instead of relying only on reusable passwords or shared secrets. Identity providers remain important for user access, but certificates can provide stronger machine identity, automated authentication and trust between services.
A strong Public Key Infrastructure specialist should understand cryptography, network security, IAM, DNS, TLS, operating systems and cloud environments. Experience with automation, Kubernetes, Active Directory, HSMs and incident response is also valuable because certificate systems cross many technical boundaries.
The right level depends on the scope and risk of the environment. A certificate inventory or ACME rollout may need focused operational knowledge, while a root authority redesign, trust migration or regulated signing service requires deep experience with architecture, governance, key protection and recovery testing.
Public Key Infrastructure work is often suitable for remote collaboration because design, documentation, automation and testing can be performed securely through controlled access. On-site work may be useful for hardware security modules, isolated networks, physical key ceremonies or teams that require local coordination.
Ask the specialist to explain the trust hierarchy, certificate lifecycle, private-key controls, revocation approach and recovery plan in practical terms. Quality is shown by clear documentation, safe automation, tested failure scenarios and an understanding of how certificates affect applications and operations.
Common causes include expired certificates, incomplete trust chains, incorrect hostnames, unsupported algorithms and missing intermediate certificates. A capable PKI professional improves inventory, ownership, monitoring and renewal automation so failures are detected before they interrupt services.
Public Key Infrastructure specialists commonly work with X.509, certificate signing requests, TLS, OCSP, CRLs and the ACME protocol. Depending on the environment, they may also use Microsoft AD CS, OpenSSL, HashiCorp Vault, cloud certificate services and commercial lifecycle management tools.
The average hourly rate of freelancers who have used Public Key Infrastructure in their recent projects is 106 €, which corresponds to a daily rate of about 848 € based on an 8-hour working day.
Of the freelancers who have used Public Key Infrastructure in their recent projects, 75% hold at least a Bachelor's degree, 50% hold at least a Master's degree, and 10% hold a doctorate.
On average, freelancers who have used Public Key Infrastructure in their recent projects have 24 years of professional experience, with a single engagement typically lasting around 1.7 years.
The most common languages among freelancers who have used Public Key Infrastructure in their recent projects are German (100%), English (97%), and French (16%).
The most common industries among freelancers who have used Public Key Infrastructure in their recent projects are Information Technology (97%), Manufacturing (57%), and Banking and Finance (56%).
The most common business areas among freelancers who have used Public Key Infrastructure in their recent projects are Information Technology (99%), Project Management (90%), and Operations (71%).
Main locations of FRATCH Experts, who have recently used Public Key Infrastructure
Our freelancers and interim experts are at home all over Germany — available on-site in Berlin, Hamburg, Munich and every major business hub, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Berlin 
Hamburg 
Munich 
Cologne 
Frankfurt 
Stuttgart In Austria our freelancers and interim experts support companies from Vienna to Graz — on-site where your project needs them, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Vienna Graz Across Switzerland our specialists are active in Zurich, Geneva, Basel and Bern — working on-site or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Zurich Geneva Basel Bern Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
