Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of certificate expiration (with renewal workflows defined) and all that possibly over some kind of web interface. Ideally the certificates could be stored on a HSM or something similar. There's currently no CA in place that needs to sign etc only a subordinate RA and this appliance should mainly act as secure storage of certificates in case of loss on user/host side but offer ease of management. Anyone ever seen this kind of thing or maybe someone could recommend a product? I don't wont to keep keys printed on paper stored in a safe.

share|improve this question
Any reason not to use OpenSSL, OS X's keychain application, Windows Certificate Services, etc. - possibly combined with encrypted storage on a USB drive or similar? (Also, printed copies of long-lived keys is not a bad idea. Our CEO is notorious for losing his PGP key, so we keep copies in the company's safe deposit box) – voretaq7♦ Aug 30 '11 at 16:09
Seems too manual to me! The user certificates themselves will be on OS X keychain, WCS, etc. but I want to have all the certs in one place known when to renew etc. Offline (encrypted) USB token is an idea but I honestly don't want to deal with USB tokens that have to be kept in a secure location (safe) - doesn't provide advantage over paper put in a safe. – pfo Aug 30 '11 at 16:12
I guess I'm not sure what problem you want to solve -- Any key management appliance will still be largely manual: You will need to put the keys on it, you will need to renew them (either through your own CA or an external CA) & likely update them on the appliance, and you will still need to keep the appliance physically (and electronically) secure. Storing backups of your private keys on an encrypted device in a physically secure location is a good practice, and you can write a simple OpenSSL script to scan the public key list and tell you when it's renewal time if you're motivated. – voretaq7♦ Aug 30 '11 at 16:21
While all you say is also my understanding of how to do with best and good practice in mind I guess I'm in need of something more "enterprisey" without a bunch of perl/sh scripts to do all that. The physical and electrical security is all in place. – pfo Aug 30 '11 at 16:30

2 Answers

up vote 0 down vote

Depending on how much you are ready to spend, you may be interested on key management applinces from any of prominent hardware vendors in this area. Here is one example.

share|improve this answer
up vote 0 down vote

You could consider using Mozilla's NSS Software Security Device.

The easiest way to do this is to import your PKCS#12 files into your certificate store in Thunderbird or Firefox. Of course, it will do more than you need, but the interface isn't too bad: it will allow you to sort your certificates per CA, CN and validity time.

I haven't tried, but it might be possible to have a standalone interface for this running with XUL runner too.

(Of course, set a master-password for this.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.