2

We've been using third party issued certificate both for public TLS encryption and internal communication. We also use issued certificates to encrypt persisted passwords.

Problem is that te certificate is valid for 1 year only and we have to redeploy it and reencrypt passwords everywhere every year.

I thought of using self signed certificates for internal communication (where I can use my own CA) and to encrypt passwords. I'd use 10 year expiration or even longer.

My question: how to safely store CA certificate? What is a reasonable expiration time for the self signed certificates derived from our CA? Are there tools to make this whole process simpler and secure?

  • 4
    Invest into HSM and keep it offline. Failing that, dedicated offline Linux box configured for paranoia running full disk encryption. Failing that, use something like EJBCA in a VM and heavily restricted access permissions. – Kirill Sinitski Apr 6 '17 at 13:09
  • It seems, that even for cloud based HSM, that's not a simple task: docs.microsoft.com/en-us/azure/key-vault/… – Igor Gatis Apr 6 '17 at 16:30
  • To do security right is often "not a simple task". – mlp May 15 '17 at 3:27
3

Problem is that te certificate is valid for 1 year only and we have to redeploy it and reencrypt passwords everywhere every year.

Actually, you should be able to get a new certificate while reusing the old keypair. That way you would still have a valid certificate while still beeing able to decrypt any data without reencryption.

how to safely store CA certificate?

The easiest and cheapest (and least secure) way is to have the CA private key in a password encrypted file on a server you consider secure. One step up would be to buy a smartcard or crypto token which features a PKCS#11 interface for storing the key and doing CA operations. The most secure option is buying a Hardware Security Module (HSM) which is technically just a very fast and very secure (and very expensive, thinks thousands to tenthousands of Euros) smartcard.

What is a reasonable expiration time for the self signed certificates derived from our CA?

keylength.com gives an overview how long keys with a certain size can be considered secure from todays perspective. You should not exceed these limits.

Are there tools to make this whole process simpler and secure?

Of course. A small and easy tool would be XCA for instance. If you plan to issue a lot of certificates or more advanced PKI features, the best open source solution out there is EJBCA. Very powerful, but it need considerable more time to get used to it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.