We're looking to host a number of client applications in our environment.
Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that.
I am not sure whether I should ask the client for keys, which we will then hold on their behalf; with all the problems of co-ordinating with the client over revocation, replacement etc but with the advantage that they will be the client's keys and so will work as expected for their users (i.e. they will show the expected cert and not one of ours).
Alternatively we could use our own keys but this would mean implementing a proper PKI, managing the full key/cert lifecycle, reassuring the client we're doing it right and of course to users they may look suspicious. But we have control.
Really not sure which way to go, although I'm inclined towards having the client provide them.
Any observations or recommendations? Am I missing a trick?