Mouhamadou Thioub

PKI/HSM expertise mission in progress for a digital subsidiary of the La Poste Group, French leader in digital trust. Intervention on a shared HSM platform serving numerous critical clients.

🎯 RESPONSIBILITIES

• Operation and MCO of a multi-brand shared HSM platform

• Organization and conduct of key ceremonies for platform clients

• Drafting and formalization of post-key ceremony validation reports

• Level 3 support and cross-functional expertise on PKI, HSM, and cryptography topics

• Contribution to the architecture and design of platform evolutions

• Critical incident management on shared HSM infrastructure

• Production of reference technical documentation: DAT, DEX, key ceremony procedures, validation reports, PKCS#11 test suites

• Consulting and support for internal clients on integrating their cryptographic use cases

• Monitoring and anticipation of regulatory changes (FIPS 140-3, post-quantum, ANSSI)

🛠️ TECHNICAL STACK

• HSM: Thales Luna, Bull Trustway Proteccio (netHSM), Utimaco, Entrust nShield

• KMS: Thales CipherTrust

• Protocols: PKCS#11, KMIP, TLS/mTLS, X.509

• PKI: ADCS, EJBCA

• Systems: Linux RHEL, Windows Server

• Standards: FIPS 140-3, ANSSI, eIDAS, RGS

🎯 CONTEXT & CHALLENGES

Critical cryptographic platform operated for demanding clients (public sector, operators of vital importance, digital trust actors). Environment with very high requirements for availability, compliance, and traceability, with rigorous cryptographic governance.

4-year PKI/HSM expertise mission with Assurance Maladie, a major player in the French public health sector. Intervention on critical cryptographic infrastructures at the heart of the French healthcare system.

🎯 RESPONSIBILITIES

• Operational management and exploitation of the PKI/HSM infrastructure

• Contribution to the InterOPS interoperability standard for secure exchange between healthcare stakeholders

• Certificate lifecycle management: issuance, renewal, revocation

• Securing inter-application exchanges via mTLS (mutual TLS) on a large fleet

• Implementation and operation of OCSP responders for real-time certificate validation

• Generation, distribution, and supervision of CRLs (Certificate Revocation Lists)

• Integration and operation of the ACME protocol for certificate issuance automation

• Key ceremonies and key loading operations on HSM

• Supervision and monitoring of PKI and HSM infrastructures

• Operational maintenance and incident management

🛠️ TECHNICAL STACK

• PKI: ADCS, EJBCA, OpenSSL

• HSM: Bull Trustway Proteccio, Entrust nShield

• Protocols: X.509, OCSP, CRL, ACME, mTLS, SCEP, PKCS#11

• Standards: InterOPS (health PKI interoperability)

• Systems: Linux, Windows Server

🎯 CONTEXT & CHALLENGES

Critical infrastructure operated for a major public health sector player, in an environment with high demands for availability, compliance (ANSSI, RGS), and security.

2-year mission with CCI Paris Île-de-France as a PKI and cryptography engineer. Involvement in the entire infrastructure lifecycle: design, deployment, MCO, and evolutions.

🎯 RESPONSIBILITIES

• Design and deployment of an enterprise PKI based on Microsoft ADCS (Active Directory Certificate Services)

• Operational maintenance (MCO) of the existing PKI and management of evolutions

• Implementation of OCSP and SCEP protocols for certificate authentication and validation

• Daily management and administration of security and PKI tools

• Participation in the migration and optimization of PKI and cryptographic infrastructures

• Supervision and monitoring of security infrastructures

• Automation of certificate lifecycle management processes

• Training and support for internal technical teams on the fundamentals of cryptography and cybersecurity

🛠️ TECHNICAL STACK

• PKI: Microsoft ADCS, OpenSSL

• Protocols: X.509, OCSP, SCEP, PKCS#10, PKCS#12

• Systems: Windows Server, Active Directory

• Scripting & automation: PowerShell

🎯 RESULTS

• Operational enterprise PKI compliant with security standards

• Reduction of operational load through automation

• Upskilling of internal technical teams on cryptographic challenges