2

I plan on making my own Certificate Authority, and already got quite a bit of money for the project, and now I need a way to issue certificates.

I was going to use OpenSSL, but it isn't great for automation and I had issues where the certificate didn't include an anchor, and the alternative DNS names didnt work. Now I need a more reliable solution.

Is there a good Linux-compatible Certificate issuing software/implementation with support for subjectAltNames, <- alternative DNS names, fairly good automation features, reliable certificate output, key generation up to 8192 bits RSA, AES256-encrypted keys, RootCA/IntermediateCA support (being able to sign Intermediate Certs with a Root CA, and having multiple Intermediates for DV,OV and EV), being able to choose with what Intemediate you want to sign the server certificate, OCSP support, CRL support, and working anchors inside certificates?

Of course, if the CA gets big, I will get devs to make me a custom implementation made for my needs, but right now, I need a pre-existing solution that is not OpenSSL or a fork of it. It should preferably be free.

migrated from crypto.stackexchange.com Dec 27 '16 at 15:53

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Related: security.stackexchange.com/q/24896/71460 – SEJPM Dec 27 '16 at 16:03
  • TL;DR: EJBCA (I won't answer because I don't have practial experience with EJBCA) – SEJPM Dec 27 '16 at 16:03
  • Also see: wiki.mozilla.org/CA:How_to_apply – SEJPM Dec 27 '16 at 16:07
  • EJBCA looks interesting, it just worries me that it is Java-based. Anyways, i will look into it. For the 1. link you sent, i already have a kinda funny key-storage solution: I use a VM(not the included one) for the issuing server, so i put the important keys on a secured partition, and just lock the partition when i'm done. A HSM will be coming later. – hungrybeast Dec 27 '16 at 16:13
  • Sadly, EJBCA doesnt really work for some reason. I downloaded their premade VM onto my private PC, but it keeps restarting. I tried a manual installation onto another Ubuntu Server VM, but it started restarting every time i tried to generate a Root CA. werid, huh? Is there another choice? – hungrybeast Dec 27 '16 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.