Hi,

I've been wondering if there exists some solutions that helps in managing the certificates tree, e.g. revoking, issuing, generating CRL list, etc.

Found:

• http://www.ejbca.org/index.html
• http://sourceforge.net/projects/phpki/

But, the first one has huge hardware requierements (written in Java). With the second, I've failed to install it just out-of-the-box.

Is it even safe, to manage such a tree via web UI ? The first problem, that comes to my mind, is that the software would have to have an access to the root.key which is rather inconvenient.

Nevertheless, how is it done in an enterprise?

Requirements:

• platform: linux
• cost: opensource

[UPDATE]
Found feature-rich solution. Maybe one would be interested in:
DogTag PKI
Unfortunately, it's Fedora/RedHat/CentOS dependent. I'll try to use it under Debian and give a note, if succeeded.


[UPDATE]
I've abandoned DogTag.
Instead, I've installed and configured EJBCA. I really recommend it. It has many features, that are important (e.g. possibility to isolate CA from RA, group & permissions management, whole certificate life-cycle, and many more).
On the homepage, there's also LiveCD available, so if one want's to test, just go for it

No idea how this is generally done in an enterprise. I manage a small CA for my department, but I get by with openssl(1)'s handy CA.pl(1) interface.

Short answer (IMO): not really!

Longer answer (IMO): sure - if you keep it on a highly restricted, hardened, non-Internet facing host. (It would of course be your responsibility to assess the level of risk and deploy accordingly.)

Actually, I use the same method right now. But it would be nice, to have some interface, when e.g. non-IT person could send a request for his/her certificate to be signed by CA or, as mentioned above, generating CRL (though it's quite simple done by CA.{pl,sh} - actually wrapped CA.{pl,sh} that also deploys the CRL to the WWW server).

Thanks for the response, anyway.

I've abandoned DogTag.
Instead, I've installed and configured EJBCA. I really recommend it. It has many features, that are important (e.g. possibility to isolate CA from RA, group & permissions management, whole certificate life-cycle, and many more).
On the homepage, there's also LiveCD available, so if one want's to test, just go for it

1 members found this post helpful.