Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I would like to have the client app able to present the csr [over the wire] to a CA which would then return a signed cert.

Are there any suggestions on the best way to get an internal CA solution like this?

share|improve this question

1 Answer 1

Well you can make web API which will sign the requests (Java, C#), and run it over SSL (HTTPS).

The secure build running web based API for signing requests, with multi-layer security filtering (firewall) and access control (physical, network, application and human factor involved), in isolated network / cabinet with physical locks.

Definitely the app should run in something like C# or Java - not PHP. Static language is far more secure, C# or Java is very good choice for the big application server, while filtering and other can be even written in C++ or use the ModSecurity.

Also you need good cryptography on each security layer - not only SSL, but also SSL based access to database, certificate authentication in database like SQL Server or Oracle, database encryption. Also session token randomization (cryptographically secure RNG), password recovery security and so on must be protected with random/crypted token.

Finally the backup of the certs and the private key preferably on different non-accessible location with replication or handling via secure copy with ssh.

As it seems properly and easy way that would work with IIS on Windows Server in C# Visual Studio, which guarantees proper isolation and resilience / filtering, as well you can use SQL Server and it's crypto API. There is also very good framework for web based API with serialization and session.

share|improve this answer
    
On windows this: msdn.microsoft.com/en-us/library/windows/desktop/… is useful for getting proper random numbers, however it looks like from C# it needs pinvoke –  Andrew Smith Aug 12 '12 at 0:35
    
Thanks, this added a couple of things I had not consdiered. My real question is about whether I have to build the web api app, or if there is something I can take and tailor for my needs. All it needs to do is accept a properly formatted request, and return a signed certificate. –  Amigadude Aug 13 '12 at 17:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.