Securing your Certificate Authority infrastructure

There are several best practices that are usually recommended to protect your CA. Some of the "legacy" advice is specific to individual CAs, but with virtualization becoming common in most data centers, this brings with it additional opportunities to streamline and secure CA infrastructures.

Legacy tried-and-true advice

The traditional advice for securing an organization's certificate infrastructure takes advantage of the fact that it is only used when certificates are being issued. If you have a good administrative handle on when new certificates will be needed, you can simply power off your CA server when it's not needed.

If you need more flexibility, you can create a hierarchal certificate infrastructure. Create a root CA for your organization, whose only job is to sign certificates that are used to create a subordinate CA (or possibly multiple subordinates). These subordinates are then used to create...