3

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the EJBCA software.

I would like to know the differences between them knowing that they all issues certificates and act as a certification authority if I'm not wrong?

Do they work differently? Are they all compliant with X.509 for example?

  • 9
    None of these examples is a CA. They are software which can be used to setup a PKI, i.e. to manage a CA. But they are not a CA themselves. A CA is a certificate authority, not a software able to implement the processes inside a certificate authority. – Steffen Ullrich Jun 10 '16 at 6:49
8

First off, let's be careful about language, when you talk about a public CA like Entrust, or Verisign, or Digicert, yes there is some software involved for actually creating and managing the certificates, but you're really talking about the people. These companies are trusted CAs not because of the software they use, but because their network admins take security seriously, because their verification specialists are meticulous about checking records before issuing a cert to a new organization (at least for EV certs). So at least 80% of what is means to be a CA is about the humans.


Right, now that that's out of the way, let's talk about the software.

You are talking about software tools to manage a Public Key Infrastructure. To be a CA, you only need 3 things in software:

  1. A public key / private key pair.

  2. A self-signed certificate for that key pair.

  3. A software tool that can sign certificate signing requests (.csrs) with that key pair.

The other 80% is policies around how you manage the data, and how much background checking you do before actually signing a .csr. The difference between different PKI software is how many bells and whistles you get.

OpenSSL is just a command-line tool for doing crypto operations. Generally speaking, it's a bare-bones command-line tool: you put a file in, it gives a file back. What you do with those files is up to you.

openssl ca -cert ca.crt -keyfile ca.key -in infile.csr -out outfile.crt

It will fully support the X.509 standard, plus some basic services for issuing CRLs, responding to OCSP, etc, but the configuration and management will be pretty hand-on.

Something like EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager (shameless plug!) are a full-blown PKI management systems that run as live webservers, responding to requests, managing their own database, and storing the CA's private keys in a networked Hardware Security Module device. In particular, they come with nice web-based management interfaces (see screenshots below), they can do automated certificate management operations through the CMP protocol, they automatically publish Certificate Revocation Lists (CRLs) every couple of hours about all the certificates they have ever issued, they respond to online revocation checks (OCSP) - ie "hey CA, is cert #23488817 still good?" -, EJBCA and Entrust Security Manager can be used by governments to issue electronic passports, Microsoft's Active Directory Certificate Services and Entrust Security Manager (I'm not sure about EJBCA) have client software that runs on the client's desktop or laptop that will talk to the CA and automatically update the certificate when it's getting close to expiring, and a whole bunch more. See EJBCA's full feature list


TL;DR: OpenSSL technically contains everything you need to run and manage a CA, but it is fairly bare-bones, requiring you to do a fair amount manually on the command-line. I can't imagine managing a PKI of more than about 5 certs with OpenSSL. The fancier PKI products offer convenience by automating as much as possible and providing fancy web-based management UIs. They are designed for systems where you are managing millions of users - think of the public root CAs that issue the SSL certs for the whole internet, or that manage email S/MIME certs for a large government department, or that manage the certificates in a nation's passports. I would guess that 70% - 80% of the CAs in the world with more than 1 million users are running one of the three PKI softwares that I've mentioned here - Microsoft ADCS, EJBCA, or Entrust SM.


(source: ejbca.org)


(source: ejbca.org)

| improve this answer | |
  • there's a few others, FOSS: gnomint.sf.net, github.com/openxpki/clca, as well as Commerical ones such as idnomic.com/?lang=en – atdre Jun 12 '16 at 16:07
  • @atdre Thanks. I'm sure an exhaustive list of every PKI software would be quite long. Do you know how commonly used those are? – Mike Ounsworth Jun 12 '16 at 16:12
  • @ Mike: No, but it would be interesting to see a comparison between them! – atdre Jun 12 '16 at 16:22
  • 2
    Just found -- github.com/cloudflare/cfssl -- and it looks superior to the other options, including support for etcd security (for CoreOS, Docker, et al) – atdre Jun 12 '16 at 18:39
  • Quibbles: openssl ca does remember the certs issued, plus revocation status, in a bare-minimum database: two flat files plus a (filesystem) directory. It does bare-minimum CRL issuance, and openssl commandline does slightly-above-minimum OCSP responder. You don't need to type all that much: most options can be put in the config file(s), and more in simple wrapper scripts. It certainly isn't as convenient, or pretty, as the competitors, but like say a mini-Cooper or old VW Beetle it does, barely, get the job done. – dave_thompson_085 Jun 13 '16 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.