Enrollment of a public key for use as a physical or logical credential

A system comprising:

• a memory storing instructions thereon;
• and
• at least one processor coupled to the memory and configured by the instructions to:
• receive, at a first PKAAC access control reader with enrollment capabilities, a PKAAC authentication request from a PKAAC-enabled client application of a client device;
• determine that the PKAAC authentication request corresponds to an identity that is unenrolled;
• collect pre-enrollment information in response to the PKAAC authentication request corresponding to the identity that is unenrolled;
• generate enrollment information based upon the pre-enrollment information, the enrollment information including authorization information indicating that the identity is authorized to access an access point;
• and
• provide, via a second PKAAC access control reader, access to the access point based on the authorization information.

A non-transitory computer-readable device having instructions thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:

• receiving, at a first PKAAC access control reader with enrollment capabilities, a PKAAC authentication request from a PKAAC-enabled client application of a client device;
• determining that the PKAAC authentication request corresponds to an identity that is unenrolled;
• collecting pre-enrollment information in response to the PKAAC authentication request corresponding to the identity that is unenrolled;
• generating enrollment information based upon the pre-enrollment information, the enrollment information including authorization information indicating that the identity is authorized to access an access point;
• and
• providing, via a second PKAAC access control reader, access to the access point based on the authorization information.