My team has had some challenges with our current internal PKI management tools and we are looking for other solutions. One of my team members forwarded me a link to a page about Lemur, an open source framework from Netflix.
It's a pretty well written article and most of what is discussed seems relevant to struggles I've seen and experienced but there's one thing that I'm confused about.
The following diagram is meant to show "a typical procurement process".
What I would typically do is generate a new key-pair on the host using something like the Java keytool. This generates the key and stores it in the keystore. Then a CSR is created and signed by the CA. The signed cert is then imported back into the store. I think this diagram can be interpreted to describe this process but it doesn't clearly show that the private key never leaves the 'deployment target'.
The proposed new procurement process looks like this:
Now, it would seem from the diagram, that the private key is generated on a separate server and then delivered (presumably via secure means) to the 'deployment target'.
The ability to generate a CSR and get the public key signed without needing to move a private key around seems pretty slick to me. I thought it was designed this way for a reason. While I can see the advantages from a convenience perspective, isn't this approach of pushing private keys inherently adding more risk of private key exposure?
The text of the article says that it can support certificates generated elsewhere which but implies that this is to help transition to using Lemur to generate them. I'm not convinced that is a step forward. Am I missing something?