My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely.
Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory lives in a git repo that IT team members clone locally on their laptops where they generate and sign VPN certs, and then update the remote repo.
The root CA private key's passphrase is stored separately in a local password management system that is itself protected with a password we don't store anywhere.
Our concern is that anyone who's ever been a member of the IT team and leaves, can easily keep a copy of the root CA private key and its passphrase and can generate and sign valid VPN certs at will even after theirs has been revoked. Currently, the only way to prevent this is to change the root CA key and re-issue VPN certs to all users (massive pain!)
What's the best practical solution that people use ?
1) Have better procedures and only generate/sign client VPN certs on a single host with a restricted access policy ? This will slow us down significantly in day to day operations and doesn't really prevent an admin to scp the private key somewhere else if they wanted to.
2) Protect the root CA key properly as above, but use intermediate certs for day-to-day VPN certs signing ? How does this work exactly ? When an IT team member leaves, I understand we can revoke the intermediate cert that's now "compromised" and issue a new one from the root CA, but what happens to the existing VPN certs that have been signed with the previous cert ? What I'm reading about intermediate certs seems to suggest that they remain valid, but I don't understand how.