The PKI is not hard(Windows one works well), but to keep it secure and safe could be more challenging.