Internal CA for Digital Signature Solution - PKI Based

Question

I'm trying to set up a digital signature solution which would work with a internal PKI.

We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a CA.

Do you know what other open-source options do we have?

Answer 1

Microsoft's Certificate Services is a CA. It does its job reasonably well(*) as long as you comply to "the Microsoft way", which means Active Directory throughout, with domains and forests and federation. This usually implies several dedicated servers.

As for open-source solutions, I heard good things about EJBCA. Some people try to do PKI "by hand" with OpenSSL (the command-line tool), but this means that you will basically write your own PKI (95% of PKI is procedures, not software) and this requires a thorough understanding of the arcanes of X.509. This is not a good plan for the unwary.

^{(*) Except that it does not scale well at all; the CA becomes sluggish after 50k issued certificates, unusable at 300k.}