I'd like to learn the top-shelf methods for designing and managing a generic X509 certificate infrastructure. There's some books here and there, but I figured I'd ask if anyone here has any favorites.

Books, web resources, etc?

(or is this not the best exchange to ask?)

1 Answer 1


Generally speaking, "shopping list" questions are frowned upon on Stack Exchange sites, because they don't map well to the Q&A format; they cannot have a complete, definitive answer, and any list unavoidably deprecates over time.

However, we can still say a few generalities (i.e. answer the meta question, aka: "how would I find good information ?"). PKI is 5% cryptography, 95% procedures. "Procedures" are what humans must do, in order to setup the CA, and in order to run it afterwards, foremost of which being the key ceremony from which the security is bootstrapped (see this answer). Though procedures are paper and humans and audits and more paper, they can only work within the limitation of the tools, i.e. what the PKI software and hardware offers. As such, the right place to begin is the manual for the core PKI software. For instance, if you want to use Microsoft's technologies ("Active Directory Certificate Services"), then start there. If you want to use EJBCA, start there. If you want your PKI to be a couple of handmade scripts around OpenSSL, then... you are not serious.

On a more meta point of view, I'd say that there are two ways to install and run a PKI properly:

  • Try to do it by yourself, using books and Web resources, and painfully making all the possible mistakes until you have really understood what a PKI is.(*)
  • Hire someone who applied the first method, and now knows.

In my own case, I find that detailed notions of what happens under the hood help a lot with debugging. So writing your own ASN.1 parser, and certificate validation engine, will grant you enough information to get a clue about what works and what does not in a PKI; you will also thoroughly hate X.509. Start with RFC 5280, which will teach you the jargon and show you what certificates can do and what they cannot. Complete that with the X.509 style guide; it is from year 2000, and thus ought to be obsolete, but is not, which says a lot about X.509.

(*) If you remember that authentication is not authorization, and therefore that trying to manage access rights through certificate revocation does not work, then you will have avoided two years of tears and teeth grinding.

  • I'm trying to do exactly what you suggested in #1; learn the procedural best practices "using books and web resources." Jan 3, 2014 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .