2

I plan on making my own Certificate Authority, and already got quite a bit of money for the project, and now I need a way to issue certificates.

I was going to use OpenSSL, but it isn't great for automation and I had issues where the certificate didn't include an anchor, and the alternative DNS names didnt work. Now I need a more reliable solution.

Is there a good Linux-compatible Certificate issuing software/implementation with support for subjectAltNames, <- alternative DNS names, fairly good automation features, reliable certificate output, key generation up to 8192 bits RSA, AES256-encrypted keys, RootCA/IntermediateCA support (being able to sign Intermediate Certs with a Root CA, and having multiple Intermediates for DV,OV and EV), being able to choose with what Intemediate you want to sign the server certificate, OCSP support, CRL support, and working anchors inside certificates?

Of course, if the CA gets big, I will get devs to make me a custom implementation made for my needs, but right now, I need a pre-existing solution that is not OpenSSL or a fork of it. It should preferably be free.

Improve this question
7
  • Related: security.stackexchange.com/q/24896/71460
    – SEJPM
    Commented Dec 27, 2016 at 16:03
  • TL;DR: EJBCA (I won't answer because I don't have practial experience with EJBCA)
    – SEJPM
    Commented Dec 27, 2016 at 16:03
  • Also see: wiki.mozilla.org/CA:How_to_apply
    – SEJPM
    Commented Dec 27, 2016 at 16:07
  • EJBCA looks interesting, it just worries me that it is Java-based. Anyways, i will look into it. For the 1. link you sent, i already have a kinda funny key-storage solution: I use a VM(not the included one) for the issuing server, so i put the important keys on a secured partition, and just lock the partition when i'm done. A HSM will be coming later.
    – hungrybeast
    Commented Dec 27, 2016 at 16:13
  • Sadly, EJBCA doesnt really work for some reason. I downloaded their premade VM onto my private PC, but it keeps restarting. I tried a manual installation onto another Ubuntu Server VM, but it started restarting every time i tried to generate a Root CA. werid, huh? Is there another choice?
    – hungrybeast
    Commented Dec 27, 2016 at 16:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.