Building a private Certificate Authority

Building a private CA starts with the same decision we've faced with each of our infrastructure packages: Which CA package should we use? As with so many server solutions, there are several to pick from. A few options are outlined here:

• OpenSSL technically gives us all the tools we need to write our own scripts and maintain our own directory structure of public key infrastructure (PKI) bits and pieces. You can create root and subordinate CAs, make a CSR, and then sign those certificates to make real certificates. In practice, while this approach is universally supported, it ends up being a bit too far on the manual side of the spectrum for most people.
• Certificate Manager is a CA bundled with Red Hat Linux and related distributions.
• openSUSE and related distributions can use the native Yet another Setup Tool (YaST) configuration and management tool as a CA.
• Easy-RSA is a set of scripts that are essentially a wrapper...