I remember reading about the necessity of air gapping the CA computer (never connecting it to any network whatsoever, no USB dongles etc).
I am preparing for setting up a number of certificates (csr's for signing, client-sides certificates for client verification in Apache, WPA2 etc) and I wonder how do I actually air gap the computer. The main questions are:
- How do I keep the OS updated?
- How do I do the actual signing (i.e. transferring the csr's to the CA computer for signing and transferring the signed certificates back)?
I understand that using intermediate certificates can make my life somewhat easier, but I do not understand how - I still need to keep the intermediate certificates as safe as possible, don't I?