I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock).

Of course I just had to revoke all my certs after updating OpenSSL and to be completely paranoid, I also want to revoke my root certificate. The question is: how am I doing this without creating a totally new CA? Is this even possible to create a new certificate for my CA?

  • CA revoking IS creating a new CA. – phoops Apr 14 '14 at 14:35

You can't do this, but there is no reason to. Unless you, for some strange reason, also used the CA certificate and key as an actual service-authorising certificate, on a machine exposed to the internet, on a service that supported TLS, it is not likely to have been compromised.

You will notice that, in the mad flurry of updates post-heartbleed, one thing we haven't seen is all the big certification agencies revoking their roots, and publishing new ones.

  • 2
    Which is - if you ever read some guidelines for root certificate authorities - bevcause those are generally OFFLINE and only used to sign sub CA keys. A computer not working can not get compromised ;) – TomTom Apr 14 '14 at 14:37
  • Thank you. Yes my CA is a server that is only internally accessible via SSH, no SSL services running – fdafgfdgfagfdagfdagfdagfdagfda Apr 14 '14 at 14:54

Normally you shall not keep your top root certificate on a machine that is online. You shall have a root certificate that is kept totally offline (like on an USB stick or 2) and have intermediate certificates that you use to sign your various others. This way, in case of a more serious security breach, you can revoke some or all of the intermediate CAs and issue new ones.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.