Commercial cert vs. Microsoft Certificate Services generated cert

Commercial cert vs. Microsoft Certificate Services generated cert
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Commercial cert vs. Microsoft Certificate Services generated cert Luckypolo 06-21-2007
Posted by =?Utf-8?B?THVja3lwb2xv?= on June 22, 2007, 10:01 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> D - yes (also cost involved although indirect)

You mean the cost of maintance and administration of such a server (machine,
configuration, backups and stuff like that)?

Thanks for help!
P.

Posted by Brian Komar on June 22, 2007, 8:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi Polo,
Here are some comments in line...

On Fri, 22 Jun 2007 00:35:00 -0700, Luckypolo wrote:

> Svyatoslav and Roger, thank you for your answers.
>
> Let me continue with collecting my conclusions:
>
> A. Making our own CA which issues certificates and signs them with the
> certificate which is signed by a world-wide trusted CA - it is an expensive
> solution and involves complicated procedures.

If you are only talking about 30 certificates, there are no economies of
scale here. This is an option more so when you want to issue 1000's of
certificates, then price savings are achieved. As you stated, it is not so
much complicated, as regulated. You must use an HSM to protect the CA's
private key, you must follow the audit procedures defined by the root CA,
etc.

>
> B. Ordering a wild card certificate for the domain *.mycompany.com - it is
> also expensive, but much more cheaper then the solution A

Just a thing to note, if you plan to use the certificate on 30 servers, I
doubt that the commercial CA vendor would allow this in their CPS or would
price it accordingly. They are a commercial business and would not
typically allow this. Your risk, if caught, is that they revoke your
certificate rendering it useless.


>
> C. Ordering a certificate for an individual DNS name - it is relatively cheap.
> I guess the coming question needs rather to search for the prices on the CA
> websites, but perhaps you know:
> When we have - let's say - 30 instalations: is the variant C (with 30
> individual certificates) still cheaper than the variant B (with wild card
> cert)?

Again, I doubt that a commercial vendor would authorize the certificate for
use on 30 *separate* machines. Now if one machine is hosting 30 sites, then
yes, it is possible.


>
> D. Making our own root CA, but with our self-signed ceritficate. Then on the
> machines running the client's applications "our root CA" should be somehow
> added to the trusted agencies.

This is the interesting statement.
- *Who* will be accessing the SSL-protected sites?
- *What* OS or browser is used to access the site?
- Do you have an Active Directory forest?
- Are all clients that connect to the application members of the forest?

If the clients are members of a forest, and are internally managed, running
Windows 2000, XP, 2003, Vista, Longhorn, then you can easily add a new root
to the systems. By installing an enterprise root CA and issuing Web Server
certs, you would automatically have the root trusted by all clients that
are members of the forest.
If it is a standalone root with a subordinate issuing CA, you can add the
root to AD using "certutil -dspublish -f <certfile> RootCA"

Even if they are not members of the forest, you can add the root CA
certificate to the trusted root store. This is all dependent on the OS,
browser, etc. If on a Windows platform, "certutil -addstore Root
<certfile>" will add the root to the trusted root store.

Brian
>
> I will be very thankful for confirmation or further comments :)
>
> Greetings,
> Polo.

Posted by =?Utf-8?B?THVja3lwb2xv?= on June 22, 2007, 9:59 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Great. Thanks a lot!
I have still some comments below:

> > C. Ordering a certificate for an individual DNS name - it is relatively
cheap.
> > I guess the coming question needs rather to search for the prices on the CA
> > websites, but perhaps you know:
> > When we have - let's say - 30 instalations: is the variant C (with 30
> > individual certificates) still cheaper than the variant B (with wild card
> > cert)?
>
> Again, I doubt that a commercial vendor would authorize the certificate for
> use on 30 *separate* machines. Now if one machine is hosting 30 sites, then
> yes, it is possible.

I thought here about 30 certificates for 30 machines - for each machine I
order a separate certificate. (and not 1 certificate for 30 machines)

So.. with the costs comparison I will check the CA prices.

> > D. Making our own root CA, but with our self-signed ceritficate. Then on the
> > machines running the client's applications "our root CA" should be somehow
> > added to the trusted agencies.
>
> This is the interesting statement.
> - *Who* will be accessing the SSL-protected sites?
> - *What* OS or browser is used to access the site?
> - Do you have an Active Directory forest?
> - Are all clients that connect to the application members of the forest?

Applications from outside - may be different vendors on different machines.
I mean machines who are not in the same Active Directory.

> Even if they are not members of the forest, you can add the root CA
> certificate to the trusted root store. This is all dependent on the OS,
> browser, etc. If on a Windows platform, "certutil -addstore Root
> <certfile>" will add the root to the trusted root store.

So I think it is a case.

> Brian

Thanks a lot!

Similar ThreadsPosted
Root CA cert expires, I renewed but I'm unable to request new cert March 7, 2006, 3:16 pm
Computer cert/User cert 802.x Authentication query August 7, 2007, 5:20 am
Problems Installing Win2K3 Cert services March 20, 2007, 10:28 pm
Re: EFS Certificate Self Signed Vs. User Cert May 26, 2005, 12:28 am
requesting cert from local CA: "no trusted certificate authorities available" November 6, 2006, 12:58 pm
Non-MS Cert Req -- How to sign with Microsoft CA? August 24, 2006, 3:56 pm
US-CERT - Microsoft Updates for Multiple Vulnerabilities July 10, 2007, 8:23 pm
how do i export a cert from my ca? February 16, 2006, 10:27 pm
Cert Server and RMS August 23, 2006, 1:35 pm
Non-domain Cert-based 802.1x using IAS November 15, 2005, 12:21 pm

The site map in XML format XML site map

Contact Us | Privacy Policy