I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I would like to have the client app able to present the csr [over the wire] to a CA which would then return a signed cert.

Are there any suggestions on the best way to get an internal CA solution like this?


Well you can make web API which will sign the requests (Java, C#), and run it over SSL (HTTPS).

The secure build running web based API for signing requests, with multi-layer security filtering (firewall) and access control (physical, network, application and human factor involved), in isolated network / cabinet with physical locks.

Definitely the app should run in something like C# or Java - not PHP. Static language is far more secure, C# or Java is very good choice for the big application server, while filtering and other can be even written in C++ or use the ModSecurity.

Also you need good cryptography on each security layer - not only SSL, but also SSL based access to database, certificate authentication in database like SQL Server or Oracle, database encryption. Also session token randomization (cryptographically secure RNG), password recovery security and so on must be protected with random/crypted token.

Finally the backup of the certs and the private key preferably on different non-accessible location with replication or handling via secure copy with ssh.

As it seems properly and easy way that would work with IIS on Windows Server in C# Visual Studio, which guarantees proper isolation and resilience / filtering, as well you can use SQL Server and it's crypto API. There is also very good framework for web based API with serialization and session.

  • On windows this: msdn.microsoft.com/en-us/library/windows/desktop/… is useful for getting proper random numbers, however it looks like from C# it needs pinvoke Aug 12 '12 at 0:35
  • Thanks, this added a couple of things I had not consdiered. My real question is about whether I have to build the web api app, or if there is something I can take and tailor for my needs. All it needs to do is accept a properly formatted request, and return a signed certificate.
    – Amigadude
    Aug 13 '12 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.