I am working on building a PKI within our organization in order to support code-signing certificates for embedded devices following a requirement from one of our clients. I have the entire design in place and the only thing missing is a CA which will issue the certificates for us. The issue is that our organization (as big as it is...) doesn't have its own CA so , I am looking into the following options :

  1. Create in-house root CA which will issue certificates (it shall correspond to "Minimum Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates, Version 1.1" according to the requierment). I researched a bit online and found 2 main approaches:

     1.Using windows server :https://msdn.microsoft.com/enus/library/ms762260(v=vs.85).aspx
     2.Using OpenSSL and linux server
  2. Use external root-CA

about option #1 :

I need to know what is the common approach and cons vs pros of each one of the 2 approached I presented( I would be glad to hear some other approaches I haven't considered as well)

about option #2 :

Which external CA service will be most suitable for my needs (signing code-singing certificates using root-CA)?

Thanks ,

  • To answer option 1, do you have Window Server installed (one you will be allowed to deploy a PKI on)? Licenced? Are you skilled more in Windows or Linux? Have you actually used OpeSSL before? Have you thought how you intend to install the root on your devices? Option 2, really will be down to cost. You will need to sign the builds of your application that you need to deploy. This usually costs per certificate issue. – ISMSDEV Jun 12 '17 at 8:12
  • Hi @ISMSDEV , I don't have an installed and licensed windows server but I can get IT guys to set it up for me , I wrote some testing scripts on with openSSL which imitates all parts of PKI (CA , certificate requester etc.) , I have a secured way to deliver the root to the devices and I already wrote the FW code to parse and verify x.509v3 certificates and store the public key and tested it on certificates generated by my testing scripts. My only issue with the openSSL approach is that I will have to manage the secured communication and worry about secured DB whereas in ms its built-in. – Dima Shifrin Jun 12 '17 at 8:19
  • Are you sure you need to have your own CA ? It's not a step to be taken lightly given the difficulty of doing it right and the near-impossibility of fixing errors after you have deployed it. If all you need is a code-signing certificate, then maybe you should consider simply purchasing one. – Stephane Jun 12 '17 at 8:45
  • In any case, best practice is to build an off-line CA (something that is NOT network accessible) and then create your certificate-issuing iCA server as children of this off-line CA. – Stephane Jun 12 '17 at 8:47

The choice of in-house or external CA will depend on a number of factors

  • Can you dictate a new root CA to be added to all the clients who will need to use these certificates? If there's a large number of clients and you don't control them, then you're likely to be better getting certificates isued by a CA who are already trusted by those clients
  • How many certificates do you need? If you need a large number of certs, then they might lead you to use an internal CA as an external one will likely charge per certificate, and this could become expensive.

Probably the main concern is, can your organization effectively manage a CA? PKI/CA management requires quite a lot of care and attention to do well. Whilst it's possible to setup OpenSSL and create a CA with a few commands, effectively running a CA has operational problems to consider. The main one is effective and secure management of certificates and their lifecycle.

As one example, you need to maintain the absolute security of the root key. Loss of this (either loss of the data or compromise of it) could lead to you having to re-issue all the certificates in question, which if you're looking at embedded devices, could be painful, depending on how easy it is to apply updates to these systems.

|improve this answer|||||
  • Rory , Thank you for your comment. we actually have a very limited set of keys we are using to sign FW so it will probably be about 3-4 certificates.from your good explanation we will probably check the approach of using an external CA. Can you please recommend known CA services which are widely used and will fit my purpose? – Dima Shifrin Jun 12 '17 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.