4 ms·
>and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks. Get an HSM - they're pretty cheap thes
by cthalupa 8y ago
>and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks.
Get an HSM - they're pretty cheap these days - and store the CA's private key in the HSM.
Or an offline CA, if you don't want to deal with the HSM.
Or, even better, do both.
- LIV2 8y agoYep! If you're an absolute tightarse it's even possible to use a smartcard/yubikey as a poor-mans HSM
- lostapathy 8y agoSo to better explain my perspective - I'm coming at this from the angle of a consultant to small to mid sized organizations. Nearly all the times somebody talks about setting up a CA, it's so they can man-in-the-middle all their network traffic to sniff it. Yet the organization struggles to do much more basic things correctly. For better or worse, though, the bias in the comments here are from competent people working for competent orgs - not smaller shops that exist in a perpetual state of garbage fire. So absolutely, yes, you can run your CA reasonably today. But in practice, outside very large and competent enterprise shops (i.e., your typical business) - no. The typical business I bump into struggles with internal DNS and DHCP - the skills just aren't there.