Preparing a Certificate Authority for state accreditation
A Certificate Authority had to close regulatory gaps, change a live public API, and migrate every customer without interrupting production.
All details that could identify the company have been altered or generalized.
Context
Dima was responsible for preparing a Certificate Authority for a state accreditation required to renew its license. The technical team was warned late, the deadline was tight, and some of the requirements affected a public API already used by existing production customers.
The challenge
Bring the system in line with current regulatory requirements, update the API, and migrate every customer with zero production downtime and no service degradation.
The uncomfortable part was that the company could not solve the regulatory problem in isolation. Every necessary API change also became a customer migration problem.
The solution
The work began with an audit of the system against the applicable legislation. The resulting plan was approved by management.
The work was split into two phases:
- Spend the first two weeks making backward-compatible changes that covered the key regulatory requirements without breaking existing customers.
- Pass the accreditation, then spend the next two weeks migrating existing customers to the new API and removing the remaining regulatory incompatibilities.
This created a safe intermediate state. The company could satisfy the immediate accreditation requirements without forcing every customer through a rushed, high-risk cutover before the review.
Dima led a cross-functional team of six across backend, frontend, QA, legal counsel, and customer success. In parallel with the system changes, the team reworked the technical documentation and prepared clear migration guides.
Dima personally joined customer calls, guided teams through the transition to the new API, and helped them make the necessary changes on their side.
The result
The state accreditation was passed, and the Certificate Authority’s license was renewed for another three years. The company avoided regulatory fines.
Every customer was migrated to the new API. The full program, from the first remediation work through the final customer migration, was completed in four weeks with zero production incidents, no downtime, and no service degradation.
The speed mattered, but the more important result was control: a regulated live system changed underneath real customers without making those customers absorb the urgency.
The next accreditation should not begin here.
If a signing, migration, or regulatory change is approaching, bring it to us while there is still room to choose the sequence.