Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to set up a digital signature solution which would work with a internal PKI.

We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a CA.

Do you know what other open-source options do we have?

share|improve this question
add comment

1 Answer

Microsoft's Certificate Services is a CA. It does its job reasonably well(*) as long as you comply to "the Microsoft way", which means Active Directory throughout, with domains and forests and federation. This usually implies several dedicated servers.

As for open-source solutions, I heard good things about EJBCA. Some people try to do PKI "by hand" with OpenSSL (the command-line tool), but this means that you will basically write your own PKI (95% of PKI is procedures, not software) and this requires a thorough understanding of the arcanes of X.509. This is not a good plan for the unwary.

(*) Except that it does not scale well at all; the CA becomes sluggish after 50k issued certificates, unusable at 300k.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.