Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I would like to ask for recommendations regarding the following issue: As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy regarding self-signed CAs and the certificates for our products.

Is it common to supply self-signed CAs to customers and allow to them to sign/manage certificates by themselves or is it more acceptable to manage our own CA to sign & supply certificates for our customers?

share|improve this question
1  
What kind of services are you protecting with SSL? Are they internally used by your customers or used by unkown people on the internet? Are the clients used to access those services provided by you or are they standard clients like a web browser or email program? – Hendrik Brummermann♦ Mar 11 '12 at 17:01
Generally speaking we have distributed management software system for our own embedded devices and applications as well for third party products that can be unsecured.So our products are internally used except vulnerability from third party products. Usually the customers networks aren't accessible to internet users.But anyway we required supply different levels of security including SSL/TLS to guard from network eavesdroppers and attakers – aeneus Mar 12 '12 at 10:02

2 Answers

up vote 1 down vote

If you need to manage a significant number of certificates then running your own (snake-oil) CA saves a lot of headaches - you can authenticate against a single signing authority, and you can revoke certificates. But if non-repudiation is ever likely to be a concern, I'd suggest you might want to provide a mechanism for the customers to generate their own CSRs for you to sign - that way you're not in the position of having access to their private keys.

share|improve this answer
up vote 0 down vote

Generally speaking, generating a keypair for a customer and then shipping them a private key and a signed cert is less than ideal from a security perspective, because it means that you know their private key. For instance, a security breach at your site could potentially compromise the security of your clients' private keys. Do you want to be in that position? For these reasons, if there is a way to set up your process so that the clients generate their keypair themselves and you just sign their public key, that may be preferable from a security perspective.

Of course, there are other factors as well. To weigh all those factors, one would probably need to know about your setting (as @Hendrik Brummermann hinted). I just want to make sure you are aware of the security risks of knowing your clients' private keys.

share|improve this answer
So if I understand correctly your suggestion we should have our own CA i.e create self signed CA and private key (by 'openssl req -x509 -new -config') and supply to customer tool allow to him to create certificate signing request (CSR) but sign the CSR by our own CA (openssl ca -config openssl.cnf -in CertName_csr.pem -out CertName.pem)? – aeneus Mar 12 '12 at 14:01
@aeneus, yes, that's the sort of approach I was anticipating. You might automate it for the customer. Caveat: the right approach for your setting is going to depend upon the specifics of, well, your setting -- like what level of involvement from customers is appropriate, how you verify/authenticate customers, what the certificates are used for, and possibly many other factors. – D.W. Mar 12 '12 at 22:27
Thank you for clarification.I'm wondering if it acceptable to go further and supply to customers a tool creating both CA and certificates of its own i.e. creating CA per customer. Since all customers are independent from each other and I don't see any need from our side to verify certificates they internally use.It also may keeps us totally unaware about customers private keys neither of CA nor certificates.Is the approach can be acceptable too? – aeneus Mar 13 '12 at 9:49
@aeneus, yes, that is also a very reasonable approach. Given your requirements, it may make even more sense: if you are not authenticating your customers, and if the customers are independent from each other (and don't need to be able to communicate with each other and verify each other), then helping each customer run their own CA probably makes even more sense. Good suggestion. – D.W. Mar 13 '12 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.