I'm trying to set up a digital signature solution which would work with a internal PKI.

We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a CA.

Do you know what other open-source options do we have?


Microsoft's Certificate Services is a CA. It does its job reasonably well(*) as long as you comply to "the Microsoft way", which means Active Directory throughout, with domains and forests and federation. This usually implies several dedicated servers.

As for open-source solutions, I heard good things about EJBCA. Some people try to do PKI "by hand" with OpenSSL (the command-line tool), but this means that you will basically write your own PKI (95% of PKI is procedures, not software) and this requires a thorough understanding of the arcanes of X.509. This is not a good plan for the unwary.

(*) Except that it does not scale well at all; the CA becomes sluggish after 50k issued certificates, unusable at 300k.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.