2

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending)

Currently it is signing them with an own non trustable Bluecoat certificate. So the browser warns you each time

Should I just allow an external software to issue as many trustable certificates as they want?

What are the best practices in this case?

Thank you!

Improve this question
4
  • If you issue the CA and then add it to your browser trust won't this be resolved? or may be i didn't get the question properly can you elaborate a bit
    – Arun
    Apr 23, 2014 at 11:07
  • If I issue a new CA certificate it will be automatically trusted, the point is: Should I give a third party app (bluecoat) to issue as many trustable certificates as it want?
    – srbob
    Apr 23, 2014 at 11:10
  • If you are going to give the app its own CA certificate , then it will issue any number of certificates it wants, Now i think the issue really comes down to whether you trust this app enough to give it CA capabilities
    – Arun
    Apr 23, 2014 at 11:15
  • Does anybody body know what do large companies about this? I guess I should trust but I'd rather know how others manage it...
    – srbob
    Apr 23, 2014 at 12:37

1 Answer 1

Reset to default
1

Reverse proxies usually present internal applications to the internet. In these cases you will usually want the certificates to be trusted by a wide range of public computers - which necessitates certificates issued by public CAs such as Verisign etc. These CAs absolutely will not give you a delegated subordinate CA for this purpose.

Wildcard certificates provide similar functionality but are high value targets to attackers - discrete certificates with limited subjects and applications are recommended here. Lets Encrypt can help you do this in a scalable and cost effective way.

If you do not need public trust, I would recommend the same practice but issued from your internal PKI. There are a range of considerations here including making sure your internal PKI's CDP and AIA URLs are available to all validating clients, possibly also through your reverse proxy solution.

I would run a country mile away from issuing CA certificates to reverse or forward proxies in my opinion.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .