I'm trying to create private CAs and saw many tutorials using openssl ca command for achieving the task. However, in the man page, I see these lines:

sample minimal CA application

The ca utility was originally meant as an example of how to do things in a CA. It was not supposed to be used as a full blown CA itself: nevertheless some people are using it for this purpose.

Sound like the command is not supposed to be actually used for doing CA tasks.

So my questions are:

  1. Are there any problems using openssl ca, or are those lines just describing some historical backgrounds?
  2. What is a preferred way to create private CAs, if there's any?

On a technical level, the text file database used by OpenSSL doesn't allow concurrent access, which may place your database at risk.

When you use any software to sign the certificate you are simply applying a function to the certificate signing request. The resulting output is a certificate. Regardless of which piece of software you use to do this, the output will be the same format - an X509 certificate.

Running a Certification Authority requires you to be able to convince relying parties that the certificates you sign are trustworthy. Specifically, when you sign the certificate you attest that to the best of your knowledge the private key is held by the entity named in the certificate, and no other entity. Relying parties should therefore be able to trust that the entity named is who/what they claim to be and no other.

In order to operate a CA and gain the trust of your relying parties you need to do much more than sign the certificate. For example, you will need to:

  • Store the transaction in a database
  • Ensure that the requestor holds the private key paired to the public key in the certificate request
  • Ensure that only you have access to the private signing key used to sign the request
  • Ensure that any authorised persons operate your CA
  • Record all transactions so that they are auditable
  • Define processes for requesting, revoking, renewing certificates etc.
  • Much, much more here - have a read of RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework for an idea of what's required

The majority of effort spent on designing and implementing a CA is concerned with the policies and procedures required to ensure trust is maintained. The majority of effort spent on CA operations is concerned with ensuring that the policies and the procedures are rigorously followed.

Unfortunately, while OpenSSL will quite happily create the certificate for you, it fails at all the other points - for example, there is no access control, nor does it store transactions in an auditable log etc. Meanwhile, software specifically written for the task considers the multitude of additional requirements needed to operate a trustworthy CA.

To sumarise - if you're playing, feel free to use OpenSSL; if you need trust, use something better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.