I've been seeing a lot of OpenSSL Certificate Authority "how tos" for Linux, but if I plan to create our own Certificate Authority for a WAN network both externally and internally...
- What is the minimum hardware requirements for setting up an OpenSSL Certificate Authority server?
- Does the Certificate Authority need to be replicated or can it just be one single server?
There isn’t. If you have a Linux install working with more than 0% disk space you should be fine
Run a benchmark, see for yourself it that performance is sufficient:
openssl speed rsa2048
For storage, you will need about 4KiB per certificate, and depending on how many certificates you will be revoking, between few KiB to 20MiB for the CRL.
That being said, I would recommend strongly against using raw
openssl
for running a production CA. Its defaults are... specific... and it's extremely easy to shoot yourself in the foot with it (do you know which KeyUse and Extended Key Use flags should your certificates have?). It's a debugging tool, not a production interface tolibcrypto.so
and definitely not one tolibssl.so
.I'd suggest using Dogtag or even better, FreeIPA for a full managed system.
A minimum functional command line only openssl CA requires almost nothing relatively speaking. The keys and certificate database for ~100 certs would be less the 100k of storage.
Your key/cert generation and signing might be a bit slow if you use really low end processor. But this only impacts creation/generation of keys/certs.
It isn't generally a good idea, but if you plan on using this same system as a distribution point for your certificate revocation lists, then you would need enough resources to run a minimal web server that can serve out static files. But this really shouldn't require much either.
If you want to use one of those fancy web-based certificate authority e.g. EJBCA then your resource requirements will go up dramatically.
I dislike using the cli tools alone, so you might want to have enough resources to run something like xca. Which still doesn't require much.