Apparatus and methods for protecting network resources

A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of protecting an organization's network resources, the method comprising:

• maintaining, by an authentication server, a first root certificate of a first cryptographic infrastructure associated with a plurality of organizations;
• maintaining a second root certificate of a second cryptographic infrastructure associated with the organization, wherein the second root certificate facilitates issuing other certificates associated with the organization to the organization's authenticators;
• issuing, to each of the organization's authenticators, an initial intermediate CA certificate within the second cryptographic infrastructure, wherein a respective authenticator's intermediate CA certificate is signed by the second root certificate, and wherein the respective authenticator is configured to provision devices for the organization using the corresponding intermediate CA certificate;
• and
• responsive to the respective authenticator issuing to a new client computing device a client certificate which is signed by the corresponding initial intermediate CA certificate, issuing to the respective authenticator a replacement intermediate CA certificate which is signed by the second root certificate, wherein the replacement intermediate CA certificate replaces the initial intermediate CA certificate.