Design and build a privately hosted Public Key Infrastructure

A Certificate Authority acts as a trusted component within the PKI. When it issues a certificate, it brings confidence that the end entity associated with a public key in a certificate owns private key.

A certificate authority must have authentication features which give it sufficient confidence that the requester and approver (registration authority) of a certificate are genuine. This could be in the form of a mutual TLS connection, or through the use of some other strong authentication method, such as a central identity provider. The goal here is to be able to authenticate and authorise every transaction or request made to a CA.

Limit certificate attributes

Once an end entity has been authenticated, the requester should only have authorisation for relevant certificates to be signed. For instance, a web server which has authenticated to the certificate authority should only be able to request a certificate that's appropriate for use with TLS.

Segmented admin of the PKI

Administration of the PKI environment should involve segregation of duty.

This could be achieved by providing role-based access control, in which an administrator will only have access to the areas of the PKI that is relevant for them. Segregation of CAs for different functional or operational requirements will also help to provide segregation of duty for the PKI environment.

If the request is high value - for example, signing an intermediate CA certificate (required when renewing or installing a new CA) - then a second factor, or person, should be in the loop, to check that the request should be authorised.