In mixed Windows/Linux environments what's the best practice for issuing server certificates? If you use Windows MSCA PKI, you're kind of stuck with using previous certificates to authenticate the renewals on non-domain machines using NDES/SCEP which is an older windows protocol. If you go the route of Linux PKI then you're probably looking at something like ACME using proof of DNS endpoint control to obtain certificates for that domain. What's the most secure way to go if you're doing it all from scratch, renewal only, DNS based, or using 3rd party tools or SaaS products to maintain and issue certs along with application secrets to only the applications running on the servers?

Is the only full solution to run a Windows and Linux PKI side-by-side using cross-trust? As far as I can tell, setting up FreeIPA to cross-trust a windows PKI is still kind of a nightmare.

  • Are you asking about server certificates for your own internal PKI, or are you talking about publicly trusted certificates? ACME is standard for the latter, but I'm not sure there's a good single answer for the former.
    – bk2204
    Sep 8 '21 at 23:05
  • @bk2204 Yes, internal. Sep 9 '21 at 0:07
  • There are 3rd party tools which integrate with MS ADCS to provide additional services such as issuance to Linux and ACME protocol support. In the 1st instance you need to define your requirements and consult your governance on permitted registration processes and controls - it may prohibit SCEP (hopefully!) which blocks you going down that route. This probably isn't a question that can be answered well here as it is opinion based and every organisation's situation is different. Sep 9 '21 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.