7

At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. However, It seems now that this trend has quickly reversed - the majority of new technology will now balk at the thought of performing trustworthy communication with a non-trusted entity.

Unfortunately, I was the first person to mention that our company should set up an internal CA, so I'm in charge of making it happen (despite having no clue what I'm doing). My question relates effort required to set up and maintain a CA. Also, I would like to verify that I am correct in choosing to ask this question on serverfault, instead of stackoverflow (this is more of a "server group" beast than a "software developer" beast, right?)

My main question: Does setting up a CA warrant the hiring of a resident expert/full-timer dedicated to maintaining the CA? Or is it a "set and forget" type of beast?

I am a software engineer by trade and I am worried that my career is going to be severely side-tracked. Already, my employer wants to use certificates for EVERYTHING (wireless security, code signing, server authentication, email signing, the list goes on...)

Should I be worried? HELP!

Edit - Additional Info:

My employer employs 2000-3000, internationally. We are a Microsoft-based company.

As far as I'm aware, we want to utilize PKI for the following:

  • Signing emails.
  • Signing documents (Word, PDF, etc).
  • Signing code (ClickOnce).
  • Making our servers trusted (For RDP sessions, Terminal Services).
  • Internal https.
  • Wireless security/authentication.
2
  • Can you explain a bit more about what you need a CA for?
    – Zoredache
    Oct 23, 2009 at 6:04
  • @Zoredache Done. Oct 23, 2009 at 13:41

4 Answers 4

5

I do PKI architecture as my day job, the answer is that it depends on the size of your organisation, the PKI you intend to implement and how well the system and your internal monitoring is set up.

If your organisation is large then there will be a lot of machines with certificates, these certificates expire, need replacing etc, however my experience is once you deploy certificates then any failure of a machine to communicate with another one is blamed on the certs before even the most basic diagnostics are performed. Ive seen certs blamed only to find the network cable unplugged.

The upshot of this is that in any large organisation you will spend a lot of time being called out to assist on these sore of issues.

I would also worry that as the PKI is an important security system you do really need to understand the theory and basics in order to make it or f value and not compromise it.

There are a lot of complex descriptions but Shon Harris does it well in her CISSP book or for a more in depth introduction Fundamentals of Cryptography by Bruce Schneier is a good place

Perhaps you could give us some information on the PKI, entrust, microsoft etc and the size of your organisation?

3
  • My edit has the additional info. Luckily, I'm already familiar with cryptography since I studied it during college and in my spare time. Oct 23, 2009 at 12:43
  • Excellent,you are looking at a pretty complex chunk of design and implementation given the scope of certificate use and the numbers of end users and entities. Its certainly the size and scale of project that companies would hire in the initial experience, it could save a lot of time and cost. Once in and with you up to speed the maintenance side of it should be manageable especially if your build is around the microsoft certificate services solution. Windows Server 2003 PKI Certificate Security is a good book from Microsoft Press if you decide to run with it yourself. Oct 24, 2009 at 11:54
  • My website is www.blacktipconsulting.com, if you use the contact form to send me your email Ill send you some PDFs and stuff that might help Oct 24, 2009 at 12:02
4

A CA really doesn't need someone to baby-sit it full time. Of course, good docs and such are important, but they're just not complicated enough to hire a Guru. If you don't have any real idea about what you're doing, hiring someone who Really Knows What Their Doing might be warranted to get it setup, but I can't imagine it'd take more than a couple of days of time to really get it sorted out, regardless of what you're using it for.

1
  • @womble: Looks like I missed your topping 10K. Happy belated 10K day! Oct 23, 2009 at 3:41
0

I too deal with a lot of PKI implementation at $job and would add that you don't need a full-time CA adminstrator as long as you..

  • Heed Mark's advice (+1) about blame culture and understanding of PKI, PKCS, etc.
  • Ensure that you have the sufficient tools to manage it from day one.

With some good utilities and basic documentation the process of issuing and revoking certificates should be simple enough for anyone to perform. We had to undertake some internal development to plug this gap. Without, it may well become an administrative nightmare, not a technical one.

0

I manage one for 20,000-user corp and its 2% of my time, but:

  • Windows 2003 CA in a domain
  • gpo to manage CA cert on machines
  • web admins have access to get their own certs using certsrv web site
  • web admins responsible for tracking when to renew; I don't tell them

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .