A certificate authority is an institution, not a program: it is whoever a community has agreed to believe when it says that a particular public key belongs to a particular server. Technically a certificate is a signed statement and trust passes down a chain from a root that every machine already holds, but the hard questions are who keeps the root’s private key, what the authority will vouch for, and what happens if the key is lost or stolen. A settlement with only one or two servers may do better to check key fingerprints in person than to run an authority at all.
Part of Networking
Certificates and chains of trust treated as a problem of people and agreement: who vouches, who decides, and when a settlement should not build an authority.
Someone Must Vouch And Everyone Must Agree Who
Encryption Basics explains that a connection needs the other end’s public key, and that the question left over is who vouches for it. A certificate is the answer: a statement, signed by an issuer, that a given name goes with a given public key, valid between two dates. Resource Sharing mentions that certificates have expiration times, which is why clocks must be right.
Trust is passed along a chain. A server’s certificate is signed by an issuer; the issuer’s certificate may be signed by a higher one; at the top is a root, which signs itself, and which a machine accepts only because it was told in advance to trust that root. The cryptography only makes the chain checkable. The decision that the root is worth believing was made by a person, and on the old internet that decision was made once, for everyone, by the organisations that put lists of roots into operating systems and browsers. A machine accepted a server because a list it never chose said it should.
That arrangement is an institution, and there is none in a settlement. Salvaged machines still carry the old lists. A root on that list belongs to a body that no longer exists to check anything, and some of the certificates on it will have expired (general knowledge), so it tells you nothing about your own servers.
The carrier Internet Infrastructure recommends creating a community authority, giving its certificate to every machine and signing all the server certificates with it, and it shows two commands that create such a root valid for 3650 days, which is 3650 / 365 = 10 years. The commands are the smallest part of the job. What lasts ten years is the responsibility, not the file.
What You Need
- A reason — the count in the worked example
- A governing body that can make and keep the decisions below (the council, in the terms of the village)
- At least two named custodians for the root’s private key
- The standard tools already on the machines that make and sign certificates (OpenSSL is the usual one, general knowledge); see the warning in Encryption Basics: use the existing software, do not write your own
- A safe, offline place for the root key
Method: Decide, Govern, Then Build
Step 1: Count whether you need an authority Use the worked example. A few servers do not justify the machinery.
Step 2: Write the policy before the key exists What will the authority vouch for (only servers the council has approved)? How will it check that a server is the one it claims (someone inspects the machine in person)? How long will its certificates last, and who renews them?
Step 3: Name the custodians and the procedure Two or more people, a written procedure, and a log of every use. The private key is used rarely, so it can live on a machine that is kept off the network, with an offline copy in a protected place.
Step 4: Create the root, and hand it out in person Give the root certificate to every machine by a person, who also reads out its fingerprint (a short fingerprint of the certificate) so the recipient can check it. How a machine comes to trust the root is the trust decision itself; sending it by the network that an impostor could also use defeats the purpose.
Step 5: Sign server certificates for a limited time A short life limits the damage from a stolen server key, and forces regular review. Put the expiry dates in a calendar that a person reads.
Step 6: Plan for the root being stolen If the root key leaks, anyone can make a certificate for any server and every machine that trusts the root will believe it. The only repair is to replace the root on every machine, by hand. The cost of that equals the number of clients, which is why the key is kept offline.
Worked Example: When Does An Authority Pay?
Compare two ways to get every client to trust every server, counting the actions people must take.
- No authority (each server’s own certificate): each client must accept each server once. S servers and C clients need S x C acceptances.
- One authority: each client installs the root once (C actions) and the authority signs each server once (S actions): C + S.
For 5 servers and 200 clients: 5 x 200 = 1,000 acceptances against 200 + 5 = 205 actions, a difference of 795. For 1 server: 1 x 200 = 200 against 200 + 1 = 201, so an authority saves nothing. For 2 servers: 400 against 202. An authority has fewer actions as soon as there are two servers, but this counts only clicks. It leaves out the governance (policy, custodians, ten years of key custody) which costs more than the clicks. So for one or two servers, installing each server’s certificate by hand and checking its fingerprint in person is the honest alternative: it is the same trust decision, made directly, and it has no root key to lose.
Common Mistakes
- Treating the root key as a file — it is the settlement’s trust; lose it or leak it and every certificate is in doubt
- A single custodian — the knowledge dies with the person
- Installing the root over the network without checking — the check is the whole point
- Certificates that never expire — nobody ever reviews anything
- Trusting salvaged root lists — they were chosen by someone else for a world that no longer exists
What’s Next
- Learn next: Access Control — who is allowed to ask the authority for anything
- Combine with: DNS Hierarchy — the other arrangement in which a community must agree on a top