## System Design Prompt Design a **Public Key Infrastructure (PKI)** for an organization to issue and manage certificates used for: - Internal **mTLS** between services - User/device certificates (optional extension) - Code signing or document signing (optional extension) ### Requirements - Secure certificate issuance and renewal (automation preferred) - Certificate revocation (compromise/termination) - Strong key protection (HSM/KMS where appropriate) - Support multiple environments (dev/stage/prod) and possibly multiple regions - Auditable operations and incident response plan ### Deliverables - CA hierarchy design (root/intermediate) - Issuance/renewal workflows - Revocation approach (CRL/OCSP) and trade-offs - Key management, rotation, and disaster recovery - Operational model (access control, auditing)