At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. However, It seems now that this trend has quickly reversed - the majority of new technology will now balk at the thought of performing trustworthy communication with a non-trusted entity.
Unfortunately, I was the first person to mention that our company should set up an internal CA, so I'm in charge of making it happen (despite having no clue what I'm doing). My question relates effort required to set up and maintain a CA. Also, I would like to verify that I am correct in choosing to ask this question on serverfault, instead of stackoverflow (this is more of a "server group" beast than a "software developer" beast, right?)
My main question: Does setting up a CA warrant the hiring of a resident expert/full-timer dedicated to maintaining the CA? Or is it a "set and forget" type of beast?
I am a software engineer by trade and I am worried that my career is going to be severely side-tracked. Already, my employer wants to use certificates for EVERYTHING (wireless security, code signing, server authentication, email signing, the list goes on...)
Should I be worried? HELP!
Edit - Additional Info:
My employer employs 2000-3000, internationally. We are a Microsoft-based company.
As far as I'm aware, we want to utilize PKI for the following:
- Signing emails.
- Signing documents (Word, PDF, etc).
- Signing code (ClickOnce).
- Making our servers trusted (For RDP sessions, Terminal Services).
- Internal https.
- Wireless security/authentication.