Can I buy a signing-valid certificate for internal use?

Question

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the barrel at having to create several dozen internal users' S/MIME certificates since (for obvious reasons, I think), I'd very much like to avoid putting the process into their hands as much as possible. An "organization level" cert is out, because "internal reasons."

So basically my question is whether it's available to buy some sort of "organizational CA" cert from an established, that will let me generate and sign S/MIME certificates, so that I can implement to Direct Project specifications without the recipients' clients worrying about untrusted certifications, or having to keep going back to the CA whenever a user joins/leaves the organization? I've tried checking some of the CAs I know of, but they seem mostly targeted at the "end user with a website" SSL certificate, so I may be missing something. Suggestions welcomed and apprciated

Add'l info: For those fortunate souls unfamiliar with it, The Direct Project standard is basically mandated every user's certificate available via either A DNS CERT RR and an externally-accessible anonymous LDAP query, and an S/MIME-capable MTA that can retrieve said cert from either location.

Answer 1

Some established CA will agree to sell you an intermediate CA certificate, but at a rather steep cost. There are several forces at hand here:

• An "established CA" is "established" by virtue of having its root key included in the usual browsers and OS. The CA operator could achieve that by signing a heavy contract with Microsoft, in which he promised to apply very strict rules when verifying the identity of certificate owners. When a CA issues an intermediate CA certificate, it delegates its power. Bluntly stated, if you buy an intermediate CA certificate from an established CA, nothing technically prevents you from then issuing a fake certificate for, e.g., "gmail.com", that all Web browsers on Earth will accept as genuine.

  Therefore, established CA have promised (with penalties in the millions of dollars) that if they ever give away an intermediate CA certificate to a third party, then they will do so only within a heavy contractual framework which would allow powerful legal retaliation, should that third party begin to issue certificates without all due care with regards to user authentication.

• Established CA make money by selling certificates. They want to keep it that way. When you buy an intermediate CA certificate, it is to issue the end user certificates yourself, and therefore to cease to buy such certificates from the established CA. From their point of view, this is lost business. So they will recoup it by pricing the intermediate CA certificate heftily.

Also, it is too easy to underestimate the costs of operating a CA. A CA is 5% cryptography, 95% procedures. Procedures mean people, and paper, and time. That's expensive. Maintaining your own CA, be it an intermediate CA from some external established CA, or a full-blown root CA of your own, is hardly worth the effort for less than, say, a thousand certificates to issue per year. People often believe that a home-made CA is just a matter of writing a couple of scripts around OpenSSL; and they are wrong.

Answer 2

VeriSign sells Digital ID (S/MIME) certificates.

http://www.symantec.com/verisign/digital-id

If you are a large enterprise and want easier auto-provisioning for new users Verisign offers enterprise options, but you have to contact them by phone.