I am working on building a PKI within our organization in order to support code-signing certificates for embedded devices following a requirement from one of our clients. I have the entire design in place and the only thing missing is a CA which will issue the certificates for us. The issue is that our organization (as big as it is...) doesn't have its own CA so , I am looking into the following options :
Create in-house root CA which will issue certificates (it shall correspond to "Minimum Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates, Version 1.1" according to the requierment). I researched a bit online and found 2 main approaches:
1.Using windows server :https://msdn.microsoft.com/enus/library/ms762260(v=vs.85).aspx 2.Using OpenSSL and linux server
Use external root-CA
about option #1 :
I need to know what is the common approach and cons vs pros of each one of the 2 approached I presented( I would be glad to hear some other approaches I haven't considered as well)
about option #2 :
Which external CA service will be most suitable for my needs (signing code-singing certificates using root-CA)?