Design a PKI for internal mTLS and certificates
Company: Coupang
Role: Software Engineer
Category: System Design
Difficulty: medium
Interview Round: Onsite
## System Design Prompt
Design a **Public Key Infrastructure (PKI)** for an organization to issue and manage certificates used for:
- Internal **mTLS** between services
- User/device certificates (optional extension)
- Code signing or document signing (optional extension)
### Requirements
- Secure certificate issuance and renewal (automation preferred)
- Certificate revocation (compromise/termination)
- Strong key protection (HSM/KMS where appropriate)
- Support multiple environments (dev/stage/prod) and possibly multiple regions
- Auditable operations and incident response plan
### Deliverables
- CA hierarchy design (root/intermediate)
- Issuance/renewal workflows
- Revocation approach (CRL/OCSP) and trade-offs
- Key management, rotation, and disaster recovery
- Operational model (access control, auditing)
Overview: This question evaluates a candidate's competency in PKI architecture, cryptographic key management, certificate lifecycle (issuance, renewal, revocation), and operational security for internal mTLS and related signing use cases.