Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. However, It seems now that this trend has quickly reversed - the majority of new technology will now balk at the thought of performing trustworthy communication with a non-trusted entity.

Unfortunately, I was the first person to mention that our company should set up an internal CA, so I'm in charge of making it happen (despite having no clue what I'm doing). My question relates effort required to set up and maintain a CA. Also, I would like to verify that I am correct in choosing to ask this question on serverfault, instead of stackoverflow (this is more of a "server group" beast than a "software developer" beast, right?)

My main question: Does setting up a CA warrant the hiring of a resident expert/full-timer dedicated to maintaining the CA? Or is it a "set and forget" type of beast?

I am a software engineer by trade and I am worried that my career is going to be severely side-tracked. Already, my employer wants to use certificates for EVERYTHING (wireless security, code signing, server authentication, email signing, the list goes on...)

Should I be worried? HELP!

Edit - Additional Info:

My employer employs 2000-3000, internationally. We are a Microsoft-based company.

As far as I'm aware, we want to utilize PKI for the following:

  • Signing emails.
  • Signing documents (Word, PDF, etc).
  • Signing code (ClickOnce).
  • Making our servers trusted (For RDP sessions, Terminal Services).
  • Internal https.
  • Wireless security/authentication.
share|improve this question
Can you explain a bit more about what you need a CA for? – Zoredache Oct 23 '09 at 6:04
@Zoredache Done. – James Jones Oct 23 '09 at 13:41
up vote 5 down vote accepted

I do PKI architecture as my day job, the answer is that it depends on the size of your organisation, the PKI you intend to implement and how well the system and your internal monitoring is set up.

If your organisation is large then there will be a lot of machines with certificates, these certificates expire, need replacing etc, however my experience is once you deploy certificates then any failure of a machine to communicate with another one is blamed on the certs before even the most basic diagnostics are performed. Ive seen certs blamed only to find the network cable unplugged.

The upshot of this is that in any large organisation you will spend a lot of time being called out to assist on these sore of issues.

I would also worry that as the PKI is an important security system you do really need to understand the theory and basics in order to make it or f value and not compromise it.

There are a lot of complex descriptions but Shon Harris does it well in her CISSP book or for a more in depth introduction Fundamentals of Cryptography by Bruce Schneier is a good place

Perhaps you could give us some information on the PKI, entrust, microsoft etc and the size of your organisation?

share|improve this answer
My edit has the additional info. Luckily, I'm already familiar with cryptography since I studied it during college and in my spare time. – James Jones Oct 23 '09 at 12:43
Excellent,you are looking at a pretty complex chunk of design and implementation given the scope of certificate use and the numbers of end users and entities. Its certainly the size and scale of project that companies would hire in the initial experience, it could save a lot of time and cost. Once in and with you up to speed the maintenance side of it should be manageable especially if your build is around the microsoft certificate services solution. Windows Server 2003 PKI Certificate Security is a good book from Microsoft Press if you decide to run with it yourself. – Mark Sutton Oct 24 '09 at 11:54
My website is, if you use the contact form to send me your email Ill send you some PDFs and stuff that might help – Mark Sutton Oct 24 '09 at 12:02

A CA really doesn't need someone to baby-sit it full time. Of course, good docs and such are important, but they're just not complicated enough to hire a Guru. If you don't have any real idea about what you're doing, hiring someone who Really Knows What Their Doing might be warranted to get it setup, but I can't imagine it'd take more than a couple of days of time to really get it sorted out, regardless of what you're using it for.

share|improve this answer
@womble: Looks like I missed your topping 10K. Happy belated 10K day! – Evan Anderson Oct 23 '09 at 3:41

I too deal with a lot of PKI implementation at $job and would add that you don't need a full-time CA adminstrator as long as you..

  • Heed Mark's advice (+1) about blame culture and understanding of PKI, PKCS, etc.
  • Ensure that you have the sufficient tools to manage it from day one.

With some good utilities and basic documentation the process of issuing and revoking certificates should be simple enough for anyone to perform. We had to undertake some internal development to plug this gap. Without, it may well become an administrative nightmare, not a technical one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.