On 20-07-2013 13:39, redpath wrote:
Very nice tutorial
http://pki-tutorial.readthedocs.org/en/latest/
So the issue is that there is no real Certificate Management Trust system
available
handling concurrency issues for a Database that works seamless with
revocation commands and
OCSP responder.
Ensuring only one program at a time uses the "openssl ca" files is your job,
it is not part ofthe sample code.
The easiest way is to *copy* for any OCSP responder you run, and to do all
the other operationsonly when you (as the CA administrator) want to, one
command (or script) at a time.
For example, using an OCSP responder that is in the know for changes in the
list of certs status
when commands are issued for revocation and when new certs are issued.
OpenSSL is great to issue real-world PKIs and use the API for cryptographic
functions.
I am a happy user there.
But you have to find something for a secure Key store as well as something
to track status
that an OCSP can be in the know, manage expiration in this keystone, reissue
certs and
revocate certs for this key store and all in the know by an OCSP.
Is this true?
For everything except the OCSP, it is a good idea to keep the CA completely
offline (not even powered on). If you want to run an OCSP consider rigging
it with pre-signed responses and/or a separate certificate for OCSP only.
I was looking at www.OpenCA.org as they have an OCSP which can integrate to
a DB.
JKS can be used to secure store keys, but of course I need something to
manage expiration of keys
auto-magically.
Java Key Storage is not such a good idea, it is no safer than regular
openssl
private key files. And then there are all those Java security bugs to deal
with.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2730 Herlev, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
