1
$\begingroup$

I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-user certificates. This way, a compromise of the intermediate CA key can be recovered by revoking that intermediate CA and generating a new one.

I see, however, CRL files need to be renewed regularly (eg. daily), which would require the root CA keys to be used. But the main goal of all this is to keep the CA keys offline. What is the best practice here?

Is there the possibility of using a separate key for CRL signing? If so, how would I do this? Question is not OpenSSL-specific but I'm using OpenSSL in case you want to provide examples.

Improve this question
$\endgroup$
3
  • $\begingroup$ Why would the root CA key be required? You can still use the intermediate CA. $\endgroup$
    – Marc
    Dec 25, 2017 at 11:02
  • 2
    $\begingroup$ @Marc note that you need regular CRLs from the root to confirm the intermediate CAs have not been revoked. As for how to do this, apparently data diodes, audio cables and half-cut ethernet cables (all for one-way communication to allow the server to output crls) have seen use / consideration. Also see this answer by the bear on secse. $\endgroup$
    – SEJPM
    Dec 25, 2017 at 11:55
  • $\begingroup$ The root CA keys seem to be needed to sign the CRL. However I'd prefer to keep them completely offline, for example in a safe. I'm wondering if there would be an alternative like it happens with OCSP, where a purpose specific certificate can be used. $\endgroup$
    – gimix
    Dec 25, 2017 at 16:23

1 Answer 1

Reset to default
2
$\begingroup$

At some point your Root CA has to have control over it's subordinate CAs. If there was a scheme where it delegates this control to another server (such as your OCSP-like suggestion), the Root CA would still need to have control over this service in some way or another. In order to assert this control you would at some point need to power up the Root CA. A scheme where the Root CA delegates full control to another service would mean that the Root CA effectively loses control; which is not what you want.

The standard way is to have the Root CA generate long-lifed CRLs. This is relatively safe as the only certificates it issues are to a very few subordinate CAs and these CAs are (should be) securely operated in accordance with the PKI's Certificate Policy with a statement describing this operation in the CA's Certification Practice Statement.

Therefore, every (for example) six months:

  1. Switch on the Root CA;
  2. Generate a new CRL;
  3. Export the CRL (for example using a CD/DVD burner);
  4. Switch off the Root CA.

This process should be formalised and if you have concerns about someone running away with a copy of your Root CA's private key, your PKI Management Authority can/should insist on the use of witnesses and/or CCTV or any other scheme it deems fit.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.