There are countless “how-to” articles and best practices recommending use of an offline root certificate authority (CA). Though as the title suggests, is this recommendation obsolete?
The context of my question is for small to medium enterprises. NOT large enterprises (or otherwise) with multiple tiers of subordinate CAs.
Revoking a Root CA Certificate, as discussed in previous posts, is a difficult process. It can only be achieved via:
- software updates
- configuration management systems
The premise of an offline root CA (metaphorically speaking) is to have it on a laptop where it is only brought online to approve a subordinate CA. Otherwise it resides in the highest physical security possible. Should a subordinate CA become compromised, not all is lost since the offline root CA is fine. However the far majority don't include a CRL Distribution Point (CDP) making it impossible to determine what certificates have been revoked. Thus making revocation of an immediate subordinate CA similar to that of a root CA revocation. Nothing was gained by having an offline root CA in the first place.
The alternative is to publish a CDP which seems to make the most sense but no longer allows the root CA to be offline. If the CDP is updated once a month, the worst case scenario is clients will not identify a revoked certificate for an entire month. Meanwhile the administration of this requires staff to boot-up the system and update the CDP monthly. Lengthening this windows (+1 month) only creates a larger window where clients would trust a revoked certificate while shortening this window makes it clear that the system should remain online due to the administrative overhead.
Based on this, it seems offline root CAs should only be used in very large enterprises with multiple tiers of subordinate CAs. Though these are minimal since often they already have a certificate infrastructure and should be considered the exception where offline root CAs are used. The far majority of new rollouts are in the small to medium size networks where the root CA should remain online so it can frequently publish to the CDP. Thus leading me back to my question, is the offline root CA obsolete?