Setup a certificate authority

Question

I am working on building a PKI within our organization in order to support code-signing certificates for embedded devices following a requirement from one of our clients. I have the entire design in place and the only thing missing is a CA which will issue the certificates for us. The issue is that our organization (as big as it is...) doesn't have its own CA so , I am looking into the following options :

1. Create in-house root CA which will issue certificates (it shall correspond to "Minimum Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates, Version 1.1" according to the requierment). I researched a bit online and found 2 main approaches:

    1.Using windows server :https://msdn.microsoft.com/enus/library/ms762260(v=vs.85).aspx
   
    2.Using OpenSSL and linux server
   

2. Use external root-CA

about option #1 :

I need to know what is the common approach and cons vs pros of each one of the 2 approached I presented( I would be glad to hear some other approaches I haven't considered as well)

about option #2 :

Which external CA service will be most suitable for my needs (signing code-singing certificates using root-CA)?

Thanks ,

Answer 1

The choice of in-house or external CA will depend on a number of factors

• Can you dictate a new root CA to be added to all the clients who will need to use these certificates? If there's a large number of clients and you don't control them, then you're likely to be better getting certificates isued by a CA who are already trusted by those clients
• How many certificates do you need? If you need a large number of certs, then they might lead you to use an internal CA as an external one will likely charge per certificate, and this could become expensive.

Probably the main concern is, can your organization effectively manage a CA? PKI/CA management requires quite a lot of care and attention to do well. Whilst it's possible to setup OpenSSL and create a CA with a few commands, effectively running a CA has operational problems to consider. The main one is effective and secure management of certificates and their lifecycle.

As one example, you need to maintain the absolute security of the root key. Loss of this (either loss of the data or compromise of it) could lead to you having to re-issue all the certificates in question, which if you're looking at embedded devices, could be painful, depending on how easy it is to apply updates to these systems.