1
$\begingroup$

It is possible for a company to deploy its own CA ? How would browsers accept the certificates ?

Supposing a company does not want to use the role of a commercial server like Windows Server or any other as a CA, how can a company deploy its own CA ?

Are there any reliable free projects that can help?

Or the company needs to hire high-level experts, get its CA approved by top level CAs and then the browsers will accept its certificates.

Improve this question
$\endgroup$
1
  • $\begingroup$ Is this for internal websites which only get visited by company machines or for public-facing websites? $\endgroup$
    – SEJPM
    Feb 1, 2017 at 15:56

1 Answer 1

Reset to default
2
$\begingroup$

This is done fairly often in companies, but any browser, client, or device which is to trust the internal CA needs to have the internal CA's root key added to its trust store. Browsers which haven't been set to trust the company's CA will not see its certificates as valid.

It's possible to run a CA using only openssl, but very painful. There are projects which make it significantly easier, such as FreeIPA.

Improve this answer
$\endgroup$
1
  • $\begingroup$ If the CA is used inside an intranet, with no connection with the Internet, the browser can't access the trust store. What can be done then? $\endgroup$
    – guglielmo london
    Feb 1, 2017 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.