In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet.
don't do it. Nope. Bad idea. Buy $10 CA signed certificates instead. Don't be your own CA. No. Nope. Bad idea — KristoferA
echo "Abandon all hope, ye who enter here." — Tom Leek
Why should one put more trust in an arbitrary CA that sells certificates for $10 than in the company's own IT department?
(I'm even inclined to trust certificates signed by suppliers or clients1, 2 more than I would trust certificates signed by the common root CA's.)
- Is keeping the CA server secure the problem?
- Is distributing and installing root certificates the problem?
- Is the RA and/or the distribution of up to date CRLs the problem?
- Is restricting who or what receives a certificate and who or what signs a certificate a problem?
- Any other problems? (Perhaps my limited knowledge, and the limited knowledge of other IT professionals in general, about all essential aspects for a secure CA. Are why KristoferA, Tom Leek, and others strongly advise against «homebrew» CA's.
Probably a professional CA will have more expertise in the first three areas and they could do better than any «smug» who creates his own CA. But still the factor of trust comes to mind especially for the last part.
1.) Given that my company has a longterm relation with these suppliers and clients.
2.) Restricted to certificates about their own servers and employees.