Background - I need to set up secure remote access for a small home office. I'm a bit of a noob and haven't needed to handle certificates before. I understand most of the setup but I want to understand the practical implications of certificate management as I have to manage the CA side too.
Simple open source router with LAN devices (mainly PCs and printer) all linked by an unmanaged switch and having a public bank of 16 IPs. There are no VLANs, no domain/radius login, no other LAN services, and no local DNS (I'm comfortable just using pure DHCP and IPs). The router natively supports incoming IPSEC/L2TP/OpenVPN. I'm tentatively leaning toward OpenVPN if there aren't good reasons for going with another (but I admit that I don't really know the practical differences).
The concern is that poor config can expose the client to the outside world. As the CA for the LAN, I have to think about the private/signing certs, and everything else, not just public certs. So I want to ensure that the security-related files generated (private certs, master keys, signing keys, whatever) are properly handled and kept+managed appropriately securely. But most resources of a level I can understand omit or are vague about security practices post-setup.
So... as a manager of the certification process (seen from the router/CA perspective) what exact certificates/keys/self-CAs must I set up, and what certificate management files must I protect and how should I do it? (file encryption on my laptop, separate USB stick, dedicated non-networked laptop, ...?) How often do I need to access these, once it's set up (security v. convenience)? Would "most" implementations store these encrypted, or do I need to worry about how the router itself holds them?
Thanks for any help!
Update 1 - Updating to clarify the roles a bit, as they aren't the same as might be expected. Usually one imagines a developer or site owner certifying to third parties via an independent CA, or an independent CA and the site owner creating certificates for various other parties. Here it's much simpler. The only purpose of creating any CA/certificates/keys is to allow one person (the LAN owner and nobody else) to connect to the LAN securely using one mechanism when away (router-native VPN) and to be sure others can't do so (within the limits of usual security disclaimers). Once it's all set up and working nicely, additional certs/keys may only rarely be needed.
The real-world scenario is that the owner has to move out shortly as the place won't be habitable due to major building works for 18 months, but the LAN will stay. My question isn't really how to generate keys and certs which has many HOWTOs, it's about the ITSec knowledge most relevant to his scenario; I'd like to bootstrap myself a bit better on the procedural knowhow, so when I follow the recipes, I have some degree of comfort that I'm not just following them, but keeping what's created fairly well secured, and not likely to be leaving the LAN all-but-open by ignorance while it's 'live' afterwards. I need some pointers what I need to do to be as sure as I can, that I'm giving him a reasonably secure setup and managing it reasonably sanely.
I probably worded that a bit dramatically :) but with luck it distinguishes and clarifies the question asked.