Resources For IT Professionals

United Kingdom (Proper English-like)

Skip to locale bar

•  

Security Best Practices for Offline Certification Authorities - TechNet Articles - United States (English) - TechNet Wiki

Private Key Protection

1. It is recommended to use a Hardware Security Module (HSM) to protect the Private Key of the CA.  HSMs can either be network attached through a private network to the CA, commonly used in virtualized offline CAs, or can be directly attached to the CA.
2. Never connect a CA to the network to reduce any attack footprint on the CA’s operating system (OS) or private key
3. Establish a chain of custody and key signing ceremony whether you are using an HSM or not

Physical and Logical Access to the Offline CAs

1. Access to the CAs should be limited only to the CA Administrator of the PKI hierarchy
2. It is recommended to disable remote access technologies to the CAs such as Remote Desktop Protocol (RDP)
3. Offline CAs should be stored in a secure location with an established chain of custody to retrieve the CA
4. Disable CD-ROM auto play, and USB ports either in the BIOS or in the virtual machine settings
5. Keep the CA offline unless you are performing maintenance tasks such as issuing a new CRL, or issuing a new certificate for a subordinate CAli>

Auditing

1. CA retrieval should be documented and audited, generally referred to, as a chain of custody, or key signing ceremony
2. The CAs should logically be enabled for auditing, which should be done in two locations:
   • The Auditing tab on the CA properties , where all settings should be enabled and then restarting the Certification Authority services after making the change
   • Object Access Auditing at the operating system has to be enabled.

Related Articles

Offline CA Maintenance Tasks
Offline Root Certification Authority