Offline Root CA
Hello, Im hoping someone can help me with this. What is the security benefit of having an offline Root CA in the case of only 1 subordinate CA? If somehow the keys were compromised on the subordinate, wouldnt they already have access to everything that is secured by the offline root? I get the concept of why you may want to do this if you had multiple subordinates, but in my situation I dont see that as ever beeing a need. Thanks
June 2nd, 2011 9:48am

The reason is simple. As long root CA is connected to the network — it increases chances to "hack" it and steal CA keys. Vulnerabilities and security misconfigurations increases them even more. What is the problem? If issuing CA is compromised (very bad) it is technically possible to revoke it's certificate on issuer. In the case of root CA it is not possible. This is because root CA cannot revoke itself and sign a CRL with already revoked CA certificate. As the result if root CA certificate is compromised you'll get a lot of problems with CA decomissioning from *all* clients who trusted your root CA.My weblog: http://en-us.sysadmins.lv PowerShell PKI Module: http://pspki.codeplex.com
Free Windows Admin Tool Kit Click here and download it now
June 2nd, 2011 12:56pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics