远程部署openssl ca实现证书签名及相关开源工具咨询

Remote OpenSSL CA Setup Using SSH #

If you want to keep your CA key secure on a remote server and only send CSRs from your local machine, SSH is the simplest way to orchestrate this without building a full API. Here's a step-by-step approach:

1. Prepare the Remote CA Server #

First, ensure your remote server has a properly configured CA environment:

• Your CA directory structure (e.g., ./demoCA with newcerts, private, certs subfolders) is set up.
• The openssl.cnf file is configured with correct paths, CA key/cert locations, and signing policies.
• The CA private key (cakey.pem) is stored securely (e.g., with restricted permissions: chmod 600 ./demoCA/private/cakey.pem).

2. Local Workflow: Send CSR, Sign, Retrieve Cert #

Assuming your remote server is accessible via SSH (let's call it ca-server), here's how to execute the process:

a. Generate CSR locally (if you haven't already)

openssl req -new -newkey rsa:2048 -nodes -keyout local-key.pem -out local-csr.pem

b. Transfer the CSR to the remote server

Use scp to send your CSR to a temporary directory on the CA server:

scp local-csr.pem user@ca-server:/tmp/

c. Run openssl ca remotely to sign the CSR

Execute the signing command over SSH. Adjust the paths to match your CA's openssl.cnf and desired output location:

ssh user@ca-server "openssl ca -config /path/to/openssl.cnf -in /tmp/local-csr.pem -out /tmp/signed-cert.pem -batch"

• The -batch flag skips interactive prompts (remove it if you want manual approval for each signing request).

d. Retrieve the signed certificate back to local

scp user@ca-server:/tmp/signed-cert.pem ./

e. Cleanup (optional but recommended)

Delete the temporary files on the remote server to avoid clutter:

ssh user@ca-server "rm /tmp/local-csr.pem /tmp/signed-cert.pem"

Security Notes #

• Use SSH key authentication instead of passwords for better security.
• Restrict SSH access to the CA server to only trusted users/IPs.
• Create a dedicated user on the CA server with minimal permissions (only access to the CA directory and openssl).

Open Source Certificate Signing Server/Client Tools #

If you want a more robust, scalable solution than manual SSH commands, here are some popular open source tools:

1. Step CA (Smallstep) #

• What it is: A lightweight, easy-to-deploy CA that supports both ACME (for public certificates) and internal PKI workflows.
• Key features: CLI client for requesting/signing certificates, automatic certificate rotation, support for TLS, SSH, and Kubernetes integration.
• How it works: Run the Step CA server on your remote host, then use the step CLI locally to submit CSRs, retrieve signed certs, or even generate keys/CSRs directly through the client.

2. HashiCorp Vault PKI Engine #

• What it is: A secrets management tool that includes a PKI (Public Key Infrastructure) engine to act as a CA.
• Key features: Fine-grained access control, certificate revocation, automatic renewal, and integration with other Vault secrets.
• How it works: Enable the PKI engine in Vault, configure it as a root or intermediate CA, then use the Vault CLI or API locally to submit CSRs and get signed certificates.

3. EJBCA #

• What it is: An enterprise-grade open source CA with full PKI lifecycle management.
• Key features: Support for multiple CAs, certificate revocation lists (CRLs), OCSP, role-based access control, and integration with LDAP/Active Directory.
• How it works: Deploy the EJBCA server, configure your CA, then use its web UI, CLI, or API to submit CSRs and manage certificates.

4. OpenCA #

• What it is: A mature open source PKI solution that handles certificate issuance, revocation, and management.
• Key features: Supports X.509 certificates, CRLs, OCSP, and has a modular architecture.
• How it works: Set up the OpenCA server, then use its CLI or web interface to interact with the CA from local machines.

内容的提问来源于stack exchange，提问作者brownmonkey