What are the pros and cons of spinning up an internal certificate authority (primarily Windows 2003 CA)? We have the need to encypt server-server traffic on a project that has 20+ certificates. We could buy certs from Verisign, but I was thinking that an internal CA might be a better long term solution. So I was looking to the community to provide a pros/cons list of what we might gain (or lose) by hosting our own CA? Thanks in advance for the help.
If you host your own CA, it will only be valid in sites/computers that have your CA's root certificate installed. In other words, just because you have your own CA does not mean that your certificates will be trusted by strangers.
If all your servers are in-house and accessed by in-house software, then your own CA is the way to go. You can deploy the CA's root certificate by GPO (if you're on a domain then installing the CA role into a server should do this automatically), and then every machine on your domain will trust it automatically.
However, if your software is accessed publically (doesn't sound like it is), then the software at the other end may very well bring up certificate warnings stating that it does not trust your published. In that case, the only option you have is to purchase an SSL certificate from a trusted publisher (there are places much, much cheaper than Verisign if you don't need their insurance policies).
An in house CA is only valid inside servers you own and and external cert is good anywhere. That's the basic answer but there is alot more to consider.
Cost- per cert cost is cheaper the more certs you generate
Revocation- it's very easy to revoke a cert you've generated, and you can give your certs short validity times
Access to free certs usually means greater usage- Usually folks will start signing their emails, and admins think about using domain and server isolation in mixed environments
Additional security requirements- This machine is possibly more important to secure than a domain controller. This system needs to be completely hardened. If you are using these certs for anything at all meaningful you need to consider the implications if those certs get compromised
Backup/high availability- Nothing says bad weekend like having HR tell you that your now dead CA gave them a cert they used to encrypt the payroll files and now can't decrypt the files because the cert can't be validated. Make sure it’s backed up often and is highly available
Liability- depending on what you want to use these for some C level exec may decide that all that money they spend on VeriSign certs is a waste because they've been using you certs just fine. If your certs get compromised and it's a VeriSign cert (and I'm simply using VeriSign as a placeholder for any third party CA) well that's easy to show that it's not your fault. If you own the CA...well it's possible that your next IT experience might be running the computerized cash register at the fast food restaurant of your choice.
Inability to use the cert external- It's not impossible to make your CA publically available, no one is going to trust a cert from your company. While that’s not a big deal it's a little more overhead to maintain 2 separate cert maintenance tasks (expiration times etc.). You could also consider buying a trusted root cert
Oh and if you need EV certs- you're upgrading to windows 2008
While it might seem like there are more cons, many of these are just things to be aware of rather than a true negative indicator.
For a bunch of internal servers, you can create certificates as needed and have them in place much quicker than using and external CA. You'll need a little experience. Tools like tinyca make if fairly easy to create a CA. For publicly accessed servers you will want certificates from an external source.
Certificates for encrypting traffic are often interally generated. If you only allow connections from your CA you don't have to worry that someone will get a certificate from your external CA and join your network. In this case the lower cost solutions may be more secure.