Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I would like to have the client app able to present the csr [over the wire] to a CA which would then return a signed cert.
Are there any suggestions on the best way to get an internal CA solution like this?
Well you can make web API which will sign the requests (Java, C#), and run it over SSL (HTTPS).
The secure build running web based API for signing requests, with multi-layer security filtering (firewall) and access control (physical, network, application and human factor involved), in isolated network / cabinet with physical locks.
Definitely the app should run in something like C# or Java - not PHP. Static language is far more secure, C# or Java is very good choice for the big application server, while filtering and other can be even written in C++ or use the ModSecurity.
Also you need good cryptography on each security layer - not only SSL, but also SSL based access to database, certificate authentication in database like SQL Server or Oracle, database encryption. Also session token randomization (cryptographically secure RNG), password recovery security and so on must be protected with random/crypted token.
Finally the backup of the certs and the private key preferably on different non-accessible location with replication or handling via secure copy with ssh.
As it seems properly and easy way that would work with IIS on Windows Server in C# Visual Studio, which guarantees proper isolation and resilience / filtering, as well you can use SQL Server and it's crypto API. There is also very good framework for web based API with serialization and session.
