With the Cyber Resilience Act (CRA) and the Network EU Directive on Security of Network and Information Systems (NIS-2), the EU has enacted two regulations that govern the cyber security of products (CRA) on the one hand and the IT security of authorities and companies on the other. Both must be implemented in around 3 years. In addition to purely organisational measures, a number of technical requirements must also be met. Digital keys and certificates are the basis for all these technical measures such as encryption and authentication. The presentation explains these relationships and shows what secure and reliable management of digital keys and certificates in OT and IoT can look like.