Jump to content

Re: Virtualized Certificate Authority Services


Recommended Posts

Guest S. Pidgorny
Posted

Yes some have virtualised the CAs. Problem being - you have difficulty using

HSMs for key storage. If HSM isn't a requirement, you're good to go.

 

At the first glimpse your plan is inconsistent (why use physical Enterprise

CA?) and overly complicated (why do you need the three subordinates?).

 

I'm cross-posting this to security groups where PKI matters are discussed a

lot.

 

--

Svyatoslav Pidgorny, MS MVP - Security, MCSE

-= F1 is the key =-

 

http://sl.mvps.org http://msmvps.com/blogs/sp

 

 

"Sam" <Sam@discussions.microsoft.com> wrote in message

news:AF43BA1A-6DB7-4DD3-9BAA-41ADF3639DEE@microsoft.com...<span style="color:blue">

>I am in the process of defining the CA architecture needs for my company.

>We

> are a single forest/domain so pretty simple and basic. Always looking to

> reduce capital costs, I was wondering if anyone has virtualized their

> entire

> CA infrastructure?

> My plan was to have a Virtual root, and filing the vmdk files in a safe

> location and then having 1 physical Enterprise, and 3 subordinates. I'd

> like

> to do all 4 intermediate and subordinates as Virtual servers rather than

> physical.

>

> Anyone experience any issues or even tried this?

>

> </span>

  • Replies 9
  • Created
  • Last Reply
Posted

Thanks for the response.

We have three geographical hubs - Western & Eastern Canada, & US with

additional plan sites. For fault tolerance, I thought it would be a good idea

to have one in each area.

I will fully admit though that I do not know very much about CA services and

am learning from reading as much as I can. I fully appreciate any feedback

you provide.

 

The enterprise CA - can it provide service to 3000 Users/Computers without

issues? I would prefer to have only one server to manage. We will basically

be using the service for EFS and some email encryption to start. Eventually

will branch out to SAP Dev and some internal Web services. Once experience is

there, will likely replace all external SSL certs within our external Web

services.

 

 

"S. Pidgorny <MVP>" wrote:

<span style="color:blue">

> Yes some have virtualised the CAs. Problem being - you have difficulty using

> HSMs for key storage. If HSM isn't a requirement, you're good to go.

>

> At the first glimpse your plan is inconsistent (why use physical Enterprise

> CA?) and overly complicated (why do you need the three subordinates?).

>

> I'm cross-posting this to security groups where PKI matters are discussed a

> lot.

>

> --

> Svyatoslav Pidgorny, MS MVP - Security, MCSE

> -= F1 is the key =-

>

> http://sl.mvps.org http://msmvps.com/blogs/sp

>

>

> "Sam" <Sam@discussions.microsoft.com> wrote in message

> news:AF43BA1A-6DB7-4DD3-9BAA-41ADF3639DEE@microsoft.com...<span style="color:green">

> >I am in the process of defining the CA architecture needs for my company.

> >We

> > are a single forest/domain so pretty simple and basic. Always looking to

> > reduce capital costs, I was wondering if anyone has virtualized their

> > entire

> > CA infrastructure?

> > My plan was to have a Virtual root, and filing the vmdk files in a safe

> > location and then having 1 physical Enterprise, and 3 subordinates. I'd

> > like

> > to do all 4 intermediate and subordinates as Virtual servers rather than

> > physical.

> >

> > Anyone experience any issues or even tried this?

> >

> > </span>

>

>

> </span>

Guest Paul Adare
Posted

On Wed, 21 May 2008 06:28:03 -0700, Sam wrote:

<span style="color:blue">

> Thanks for the response.

> We have three geographical hubs - Western & Eastern Canada, & US with

> additional plan sites. For fault tolerance, I thought it would be a good idea

> to have one in each area.

> I will fully admit though that I do not know very much about CA services and

> am learning from reading as much as I can. I fully appreciate any feedback

> you provide.

>

> The enterprise CA - can it provide service to 3000 Users/Computers without

> issues? I would prefer to have only one server to manage. We will basically

> be using the service for EFS and some email encryption to start. Eventually

> will branch out to SAP Dev and some internal Web services. Once experience is

> there, will likely replace all external SSL certs within our external Web

> services. </span>

 

Your original post is kind of confusing. You state that you plan to have 1

physical Enterprise and 3 subordinates, what exactly do you mean by that?

Also what do you mean by "all 4 intermediate and subordinates"?

 

As far as the above, are you planning on only doing email

signing/encryption internally or will you users be exchanging

signed/encrypted email with others outside of your company? Similar

question for the external SSL certs. Who will be using the external web

sites, employees, external users, or both. If you plan on having

non-employees consume your email or SSL certs then you're going to have

problems as they won't trust your root and therefore won't accept your

certificates issued in that chain.

How many email/external SSL certs are you looking at issuing?

<span style="color:blue">

>

>

> "S. Pidgorny <MVP>" wrote:

> <span style="color:green">

>> Yes some have virtualised the CAs. Problem being - you have difficulty using

>> HSMs for key storage. If HSM isn't a requirement, you're good to go.

>>

>> At the first glimpse your plan is inconsistent (why use physical Enterprise

>> CA?) and overly complicated (why do you need the three subordinates?).

>>

>> I'm cross-posting this to security groups where PKI matters are discussed a

>> lot.

>>

>> --

>> Svyatoslav Pidgorny, MS MVP - Security, MCSE

>> -= F1 is the key =-

>>

>> http://sl.mvps.org http://msmvps.com/blogs/sp

>>

>>

>> "Sam" <Sam@discussions.microsoft.com> wrote in message

>> news:AF43BA1A-6DB7-4DD3-9BAA-41ADF3639DEE@microsoft.com...<span style="color:darkred">

>>>I am in the process of defining the CA architecture needs for my company.

>>>We

>>> are a single forest/domain so pretty simple and basic. Always looking to

>>> reduce capital costs, I was wondering if anyone has virtualized their

>>> entire

>>> CA infrastructure?

>>> My plan was to have a Virtual root, and filing the vmdk files in a safe

>>> location and then having 1 physical Enterprise, and 3 subordinates. I'd

>>> like

>>> to do all 4 intermediate and subordinates as Virtual servers rather than

>>> physical.

>>>

>>> Anyone experience any issues or even tried this?

>>>

>>> </span>

>>

>>

>></span></span>

 

 

--

Paul Adare

http://www.identit.ca

Variables won't; constants aren't. -- Osborn

Posted

Sorry for the confusion. My plan is/was to have one enterprise CA

(intermediate) and 3 subordinate issuing servers. My original question asked

if anyone has virtualized (using VMWARE specifically) for their CA

environment.

 

I would like to have just one Enterprise CA if possible as the less servers

I have to manage the better. For now we will only be using the certificates

internally for email and EFS.

 

Externally, we have about 10 SSL Certificates all through Verisign and

please note I still have lots to learn about all of this and if issuing our

own SSL certs will cause problems with our Customers, I will keep the Versign

version. The external Certs are used by non-employees and employees.

<span style="color:blue">

> Your original post is kind of confusing. You state that you plan to have 1

> physical Enterprise and 3 subordinates, what exactly do you mean by that?

> Also what do you mean by "all 4 intermediate and subordinates"?

>

> As far as the above, are you planning on only doing email

> signing/encryption internally or will you users be exchanging

> signed/encrypted email with others outside of your company? Similar

> question for the external SSL certs. Who will be using the external web

> sites, employees, external users, or both. If you plan on having

> non-employees consume your email or SSL certs then you're going to have

> problems as they won't trust your root and therefore won't accept your

> certificates issued in that chain.

> How many email/external SSL certs are you looking at issuing?

> <span style="color:green">

> >

> >

> > "S. Pidgorny <MVP>" wrote:

> > <span style="color:darkred">

> >> Yes some have virtualised the CAs. Problem being - you have difficulty using

> >> HSMs for key storage. If HSM isn't a requirement, you're good to go.

> >>

> >> At the first glimpse your plan is inconsistent (why use physical Enterprise

> >> CA?) and overly complicated (why do you need the three subordinates?).

> >>

> >> I'm cross-posting this to security groups where PKI matters are discussed a

> >> lot.

> >>

> >> --

> >> Svyatoslav Pidgorny, MS MVP - Security, MCSE

> >> -= F1 is the key =-

> >>

> >> http://sl.mvps.org http://msmvps.com/blogs/sp

> >>

> >>

> >> "Sam" <Sam@discussions.microsoft.com> wrote in message

> >> news:AF43BA1A-6DB7-4DD3-9BAA-41ADF3639DEE@microsoft.com...

> >>>I am in the process of defining the CA architecture needs for my company.

> >>>We

> >>> are a single forest/domain so pretty simple and basic. Always looking to

> >>> reduce capital costs, I was wondering if anyone has virtualized their

> >>> entire

> >>> CA infrastructure?

> >>> My plan was to have a Virtual root, and filing the vmdk files in a safe

> >>> location and then having 1 physical Enterprise, and 3 subordinates. I'd

> >>> like

> >>> to do all 4 intermediate and subordinates as Virtual servers rather than

> >>> physical.

> >>>

> >>> Anyone experience any issues or even tried this?

> >>>

> >>>

> >>

> >>

> >></span></span>

>

>

> --

> Paul Adare

> http://www.identit.ca

> Variables won't; constants aren't. -- Osborn

> </span>

Guest Jorge de Almeida Pinto [MVP - DS
Posted

> Yes some have virtualised the CAs. Problem being - you have difficulty <span style="color:blue">

> using

> HSMs for key storage. If HSM isn't a requirement, you're good to go.</span>

 

true, but it depends on the type of HSMs you want to use for the CA

 

--

 

Cheers,

(HOPEFULLY THIS INFORMATION HELPS YOU!)

 

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

 

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx

BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx

------------------------------------------------------------------------------------------

How to ask a question --> http://support.microsoft.com/?id=555375

------------------------------------------------------------------------------------------

This posting is provided "AS IS" with no warranties and confers no rights!

Always test ANY suggestion in a test environment before implementing!

------------------------------------------------------------------------------------------

#################################################

#################################################

------------------------------------------------------------------------------------------

"Sam" <Sam@discussions.microsoft.com> wrote in message

news:B9166C87-649A-4A11-8C92-4FDEFB1CCE25@microsoft.com...<span style="color:blue">

> Thanks for the response.

> We have three geographical hubs - Western & Eastern Canada, & US with

> additional plan sites. For fault tolerance, I thought it would be a good

> idea

> to have one in each area.

> I will fully admit though that I do not know very much about CA services

> and

> am learning from reading as much as I can. I fully appreciate any feedback

> you provide.

>

> The enterprise CA - can it provide service to 3000 Users/Computers without

> issues? I would prefer to have only one server to manage. We will

> basically

> be using the service for EFS and some email encryption to start.

> Eventually

> will branch out to SAP Dev and some internal Web services. Once experience

> is

> there, will likely replace all external SSL certs within our external Web

> services.

>

>

> "S. Pidgorny <MVP>" wrote:

><span style="color:green">

>> Yes some have virtualised the CAs. Problem being - you have difficulty

>> using

>> HSMs for key storage. If HSM isn't a requirement, you're good to go.

>>

>> At the first glimpse your plan is inconsistent (why use physical

>> Enterprise

>> CA?) and overly complicated (why do you need the three subordinates?).

>>

>> I'm cross-posting this to security groups where PKI matters are discussed

>> a

>> lot.

>>

>> --

>> Svyatoslav Pidgorny, MS MVP - Security, MCSE

>> -= F1 is the key =-

>>

>> http://sl.mvps.org http://msmvps.com/blogs/sp

>>

>>

>> "Sam" <Sam@discussions.microsoft.com> wrote in message

>> news:AF43BA1A-6DB7-4DD3-9BAA-41ADF3639DEE@microsoft.com...<span style="color:darkred">

>> >I am in the process of defining the CA architecture needs for my

>> >company.

>> >We

>> > are a single forest/domain so pretty simple and basic. Always looking

>> > to

>> > reduce capital costs, I was wondering if anyone has virtualized their

>> > entire

>> > CA infrastructure?

>> > My plan was to have a Virtual root, and filing the vmdk files in a safe

>> > location and then having 1 physical Enterprise, and 3 subordinates. I'd

>> > like

>> > to do all 4 intermediate and subordinates as Virtual servers rather

>> > than

>> > physical.

>> >

>> > Anyone experience any issues or even tried this?

>> >

>> ></span>

>>

>>

>> </span></span>

Guest Paul Adare
Posted

On Thu, 22 May 2008 02:23:30 +0200, Jorge de Almeida Pinto [MVP - DS]

wrote:

<span style="color:blue"><span style="color:green">

>> Yes some have virtualised the CAs. Problem being - you have difficulty

>> using

>> HSMs for key storage. If HSM isn't a requirement, you're good to go.</span>

>

> true, but it depends on the type of HSMs you want to use for the CA</span>

 

You are obviously limited to network attached HSMs and even then, depending

on the vendor there maybe some limitations. For example if you're using an

nCipher netHSM you can't implement the nToken cards to further secure

communications. Also, one's CPS may prohibit attaching an offline CA to a

network entirely.

 

--

Paul Adare

http://www.identit.ca

Real programs don't eat cache.

Guest Paul Adare
Posted

On Wed, 21 May 2008 08:16:00 -0700, Sam wrote:

<span style="color:blue">

> Sorry for the confusion. My plan is/was to have one enterprise CA

> (intermediate) and 3 subordinate issuing servers.</span>

 

So to clarify, you plan on implementing:

 

1 offline root as a standalone CA

1 online policy (intermediate) Enterprise CA

3 online issuing standalone CAs

 

Is that correct? If so, then given your original scenario you don't really

need 3 tiers, and even if you were to implement 3 tiers the policy or

intermediate tier should also be offline and be a standalone CA, not an

Enterprise CA and your online issuing CAs should be the Enterprise CAs.

<span style="color:blue">

> My original question asked

> if anyone has virtualized (using VMWARE specifically) for their CA

> environment.</span>

 

VMWare is not officially supported for Certificate Services. Virtual Server

2005 R2 SP1 is.

<span style="color:blue">

>

> I would like to have just one Enterprise CA if possible as the less servers

> I have to manage the better. For now we will only be using the certificates

> internally for email and EFS.</span>

 

I don't think you understand the differences between standalone and

Enterprise CAs. You're far better off making your 3 issuing CAs Enterprise

CAs as then you get all of the benefits of being able to manage them as you

would any member server. Standalone CAs are more of a management burden and

provide less functionality.

<span style="color:blue">

>

> Externally, we have about 10 SSL Certificates all through Verisign and

> please note I still have lots to learn about all of this and if issuing our

> own SSL certs will cause problems with our Customers, I will keep the Versign

> version. The external Certs are used by non-employees and employees.</span>

 

The problem with certificates that are issued internally is that no one

outside of your organization will trust your root CA and a PKI is all about

trust. If you use internally issued SSL certs for your external web sites,

everyone who visits your site will receive a warning about the cert being

issued by a CA they don't trust. IF you're only dealing with 10 external

certs then you're better off to keep purchasing these.

 

--

Paul Adare

http://www.identit.ca

On a clear disk you can seek forever. -- Denning

Guest krutz
Posted

Hi all,

 

We are using 1 physical ROOT CA, 3 virtual Policy (Intermediate) CAs

and 3 virtual Issuing CAs. We also have installed 1 Safenet LUNA SA

networked HSM for the ROOT CA only and 1 Safenet LUNA SA networked HSM

- Multi partition for the Policy and Issuing CAs.

 

It is obvious that the ROOT CA & HSM are offline and powered up only

when the CRL needs to be republished or a new Policy CA needs to be

part of the path.

All 3 Policy and 3 Issuing CAs are always powered and used for

certificate issuing.

 

I do not understand why you would have an Intermediate Enterprise CA

and Issuing Standalone CAs. I would do the contrary. All certificates

that will be issued will come from the Issuing CAs. In order to have

flexibility for the issuance of certificates for AD users and

computers, Enterprise CAs are necessary.

 

I know that it is possible to have local Enterprise Issuing CAs linked

to a third party WEB Trusted ROOT CA. This would take off the hassle

of installing and maintaining a ROOT CA and Intermediate CAs.

Moreover, the ROOT CA I am mentioning is automatically trusted in IE,

Opera, Safari and soon in Mozilla.

 

If you think this would be of an interest, I could check and give you

the company name that provides such possibilities..

Regards.

 

 

 

On May 22, 6:42 am, Paul Adare <pkad...@gmail.com> wrote:<span style="color:blue">

> On Wed, 21 May 2008 08:16:00 -0700, Sam wrote:<span style="color:green">

> > Sorry for the confusion. My plan is/was to have one enterprise CA

> > (intermediate) and 3 subordinate issuing servers.</span>

>

> So to clarify, you plan on implementing:

>

> 1 offline root as a standalone CA

> 1 online policy (intermediate) Enterprise CA

> 3 online issuing standalone CAs

>

> Is that correct? If so, then given your original scenario you don't really

> need 3 tiers, and even if you were to implement 3 tiers the policy or

> intermediate tier should also be offline and be a standalone CA, not an

> Enterprise CA and your online issuing CAs should be the Enterprise CAs.

><span style="color:green">

> >  My original question asked

> > if anyone has virtualized (using VMWARE specifically) for their CA

> > environment.</span>

>

> VMWare is not officially supported for Certificate Services. Virtual Server

> 2005 R2 SP1 is.

>

>

><span style="color:green">

> > I would like to have just one Enterprise CA if possible as the less servers

> > I have to manage the better. For now we will only be using the certificates

> > internally for email and EFS.</span>

>

> I don't think you understand the differences between standalone and

> Enterprise CAs. You're far better off making your 3 issuing CAs Enterprise

> CAs as then you get all of the benefits of being able to manage them as you

> would any member server. Standalone CAs are more of a management burden and

> provide less functionality.

>

>

><span style="color:green">

> > Externally, we have about 10 SSL Certificates all through Verisign and

> > please note I still have lots to learn about all of this and if issuing our

> > own SSL certs will cause problems with our Customers, I will keep the Versign

> > version. The external Certs are used by non-employees and employees.</span>

>

> The problem with certificates that are issued internally is that no one

> outside of your organization will trust your root CA and a PKI is all about

> trust. If you use internally issued SSL certs for your external web sites,

> everyone who visits your site will receive a warning about the cert being

> issued by a CA they don't trust. IF you're only dealing with 10 external

> certs then you're better off to keep purchasing these.

>

> --

> Paul Adarehttp://www.identit.ca

> On a clear disk you can seek forever.  -- Denning</span>

Posted

Thank you for your response and time. I will keep only enterprise CA's and it

is obvious I still have a lot to read and learn before I implement this

environment.

 

"Paul Adare" wrote:

<span style="color:blue">

> On Wed, 21 May 2008 08:16:00 -0700, Sam wrote:

> <span style="color:green">

> > Sorry for the confusion. My plan is/was to have one enterprise CA

> > (intermediate) and 3 subordinate issuing servers.</span>

>

> So to clarify, you plan on implementing:

>

> 1 offline root as a standalone CA

> 1 online policy (intermediate) Enterprise CA

> 3 online issuing standalone CAs

>

> Is that correct? If so, then given your original scenario you don't really

> need 3 tiers, and even if you were to implement 3 tiers the policy or

> intermediate tier should also be offline and be a standalone CA, not an

> Enterprise CA and your online issuing CAs should be the Enterprise CAs.

> <span style="color:green">

> > My original question asked

> > if anyone has virtualized (using VMWARE specifically) for their CA

> > environment.</span>

>

> VMWare is not officially supported for Certificate Services. Virtual Server

> 2005 R2 SP1 is.

> <span style="color:green">

> >

> > I would like to have just one Enterprise CA if possible as the less servers

> > I have to manage the better. For now we will only be using the certificates

> > internally for email and EFS.</span>

>

> I don't think you understand the differences between standalone and

> Enterprise CAs. You're far better off making your 3 issuing CAs Enterprise

> CAs as then you get all of the benefits of being able to manage them as you

> would any member server. Standalone CAs are more of a management burden and

> provide less functionality.

> <span style="color:green">

> >

> > Externally, we have about 10 SSL Certificates all through Verisign and

> > please note I still have lots to learn about all of this and if issuing our

> > own SSL certs will cause problems with our Customers, I will keep the Versign

> > version. The external Certs are used by non-employees and employees.</span>

>

> The problem with certificates that are issued internally is that no one

> outside of your organization will trust your root CA and a PKI is all about

> trust. If you use internally issued SSL certs for your external web sites,

> everyone who visits your site will receive a warning about the cert being

> issued by a CA they don't trust. IF you're only dealing with 10 external

> certs then you're better off to keep purchasing these.

>

> --

> Paul Adare

> http://www.identit.ca

> On a clear disk you can seek forever. -- Denning

> </span>

Guest krutz
Posted

Depending on your final use of computer and end user certificates,

they need to be trusted when used in a public world.

Either you use an available publically trusted ROOT CA or you will

have to create your own ROOT CA and distribute it to all your

potential partners and clients (nearly impossible to manage in a

medium to large scale).

 

Regards,

 

 

 

On May 22, 3:17 pm, Sam <S...@discussions.microsoft.com> wrote:<span style="color:blue">

> Thank you for your response and time. I will keep only enterprise CA's and it

> is obvious I still have a lot to read and learn before I implement this

> environment.

>

>

>

> "Paul Adare" wrote:<span style="color:green">

> > On Wed, 21 May 2008 08:16:00 -0700, Sam wrote:</span>

><span style="color:green"><span style="color:darkred">

> > > Sorry for the confusion. My plan is/was to have one enterprise CA

> > > (intermediate) and 3 subordinate issuing servers.</span></span>

><span style="color:green">

> > So to clarify, you plan on implementing:</span>

><span style="color:green">

> > 1 offline root as a standalone CA

> > 1 online policy (intermediate) Enterprise CA

> > 3 online issuing standalone CAs</span>

><span style="color:green">

> > Is that correct? If so, then given your original scenario you don't really

> > need 3 tiers, and even if you were to implement 3 tiers the policy or

> > intermediate tier should also be offline and be a standalone CA, not an

> > Enterprise CA and your online issuing CAs should be the Enterprise CAs.</span>

><span style="color:green"><span style="color:darkred">

> > >  My original question asked

> > > if anyone has virtualized (using VMWARE specifically) for their CA

> > > environment.</span></span>

><span style="color:green">

> > VMWare is not officially supported for Certificate Services. Virtual Server

> > 2005 R2 SP1 is.</span>

><span style="color:green"><span style="color:darkred">

> > > I would like to have just one Enterprise CA if possible as the less servers

> > > I have to manage the better. For now we will only be using the certificates

> > > internally for email and EFS.</span></span>

><span style="color:green">

> > I don't think you understand the differences between standalone and

> > Enterprise CAs. You're far better off making your 3 issuing CAs Enterprise

> > CAs as then you get all of the benefits of being able to manage them as you

> > would any member server. Standalone CAs are more of a management burden and

> > provide less functionality.</span>

><span style="color:green"><span style="color:darkred">

> > > Externally, we have about 10 SSL Certificates all through Verisign and

> > > please note I still have lots to learn about all of this and if issuing our

> > > own SSL certs will cause problems with our Customers, I will keep the Versign

> > > version. The external Certs are used by non-employees and employees.</span></span>

><span style="color:green">

> > The problem with certificates that are issued internally is that no one

> > outside of your organization will trust your root CA and a PKI is all about

> > trust. If you use internally issued SSL certs for your external web sites,

> > everyone who visits your site will receive a warning about the cert being

> > issued by a CA they don't trust. IF you're only dealing with 10 external

> > certs then you're better off to keep purchasing these.</span>

><span style="color:green">

> > --

> > Paul Adare

> >http://www.identit.ca

> > On a clear disk you can seek forever.  -- Denning- Hide quoted text -</span>

>

> - Show quoted text -</span>

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...