up vote 2 down vote favorite
share [g+] share [fb]

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of certificate expiration (with renewal workflows defined) and all that possibly over some kind of web interface. Ideally the certificates could be stored on a HSM or something similar. There's currently no CA in place that needs to sign etc only a subordinate RA and this appliance should mainly act as secure storage of certificates in case of loss on user/host side but offer ease of management. Anyone ever seen this kind of thing or maybe someone could recommend a product? I don't wont to keep keys printed on paper stored in a safe.

link|improve this question
58% accept rate
Any reason not to use OpenSSL, OS X's keychain application, Windows Certificate Services, etc. - possibly combined with encrypted storage on a USB drive or similar? (Also, printed copies of long-lived keys is not a bad idea. Our CEO is notorious for losing his PGP key, so we keep copies in the company's safe deposit box) – voretaq7♦ Aug 30 '11 at 16:09
Seems too manual to me! The user certificates themselves will be on OS X keychain, WCS, etc. but I want to have all the certs in one place known when to renew etc. Offline (encrypted) USB token is an idea but I honestly don't want to deal with USB tokens that have to be kept in a secure location (safe) - doesn't provide advantage over paper put in a safe. – pfo Aug 30 '11 at 16:12
I guess I'm not sure what problem you want to solve -- Any key management appliance will still be largely manual: You will need to put the keys on it, you will need to renew them (either through your own CA or an external CA) & likely update them on the appliance, and you will still need to keep the appliance physically (and electronically) secure. Storing backups of your private keys on an encrypted device in a physically secure location is a good practice, and you can write a simple OpenSSL script to scan the public key list and tell you when it's renewal time if you're motivated. – voretaq7♦ Aug 30 '11 at 16:21
While all you say is also my understanding of how to do with best and good practice in mind I guess I'm in need of something more "enterprisey" without a bunch of perl/sh scripts to do all that. The physical and electrical security is all in place. – pfo Aug 30 '11 at 16:30
feedback

1 Answer

up vote 0 down vote

Depending on how much you are ready to spend, you may be interested on key management applinces from any of prominent hardware vendors in this area. Here is one example.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.