Comparison and difference between CAs

Question

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the EJBCA software.

I would like to know the differences between them knowing that they all issues certificates and act as a certification authority if I'm not wrong?

Do they work differently? Are they all compliant with X.509 for example?

Answer 1

First off, let's be careful about language, when you talk about a public CA like Entrust, or Verisign, or Digicert, yes there is some software involved for actually creating and managing the certificates, but you're really talking about the people. These companies are trusted CAs not because of the software they use, but because their network admins take security seriously, because their verification specialists are meticulous about checking records before issuing a cert to a new organization (at least for EV certs). So at least 80% of what is means to be a CA is about the humans.

---

Right, now that that's out of the way, let's talk about the software.

You are talking about software tools to manage a Public Key Infrastructure. To be a CA, you only need 3 things in software:

1. A public key / private key pair.

2. A self-signed certificate for that key pair.

3. A software tool that can sign certificate signing requests (.csrs) with that key pair.

The other 80% is policies around how you manage the data, and how much background checking you do before actually signing a .csr. The difference between different PKI software is how many bells and whistles you get.

OpenSSL is just a command-line tool for doing crypto operations. Generally speaking, it's a bare-bones command-line tool: you put a file in, it gives a file back. What you do with those files is up to you.

openssl ca -cert ca.crt -keyfile ca.key -in infile.csr -out outfile.crt

It will fully support the X.509 standard, plus some basic services for issuing CRLs, responding to OCSP, etc, but the configuration and management will be pretty hand-on.

Something like EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager (shameless plug!) are a full-blown PKI management systems that run as live webservers, responding to requests, managing their own database, and storing the CA's private keys in a networked Hardware Security Module device. In particular, they come with nice web-based management interfaces (see screenshots below), they can do automated certificate management operations through the CMP protocol, they automatically publish Certificate Revocation Lists (CRLs) every couple of hours about all the certificates they have ever issued, they respond to online revocation checks (OCSP) - ie "hey CA, is cert #23488817 still good?" -, EJBCA and Entrust Security Manager can be used by governments to issue electronic passports, Microsoft's Active Directory Certificate Services and Entrust Security Manager (I'm not sure about EJBCA) have client software that runs on the client's desktop or laptop that will talk to the CA and automatically update the certificate when it's getting close to expiring, and a whole bunch more. See EJBCA's full feature list

---

TL;DR: OpenSSL technically contains everything you need to run and manage a CA, but it is fairly bare-bones, requiring you to do a fair amount manually on the command-line. I can't imagine managing a PKI of more than about 5 certs with OpenSSL. The fancier PKI products offer convenience by automating as much as possible and providing fancy web-based management UIs. They are designed for systems where you are managing millions of users - think of the public root CAs that issue the SSL certs for the whole internet, or that manage email S/MIME certs for a large government department, or that manage the certificates in a nation's passports. I would guess that 70% - 80% of the CAs in the world with more than 1 million users are running one of the three PKI softwares that I've mentioned here - Microsoft ADCS, EJBCA, or Entrust SM.

_{(source: ejbca.org)}

_{(source: ejbca.org)}