I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem.

When I stress-test my CA by making hundreds of concurrent certificate signing requests, I occasionally see weird errors such as

unable to rename ./index.txt.attr.new to ./index.txt.attr
reason: No such file or directory

I'm not sure whether this is an OpenSSL bug or an issue with my distributed file system, but using text files to hold all certificate data seems generally bad for concurrent access, so I'd rather switch to a more robust architecture than debug this particular issue.

Ideally, I'd like a certificate authority that stores its state in a proper database rather than text files. It doesn't look like OpenSSL can do that. The documentation for the database parameter at http://www.openssl.org/docs/apps/ca.html#CONFIGURATION_FILE_OPTIONS says

the text database file to use. Mandatory. This file must be present though initially it will be empty.

Could anyone recommend a good open source database-backed X.509 certificate authority for Linux?

  • I've exported the certificate authority folder on a distributed filesystem - Uhm, what?? That typically contains the private key, which must be kept private. Don't do that. Anyway, what are the keys for? What OS are all the machines? If this is a *nix network, I would look at one of the puppet modules. – Zoredache Oct 12 '13 at 9:48
  • Zoredache- don't worry, I'm not sharing the private keys with everyone. :) The setup is roughly like this. Many clients need signed certificates to get access to VPN's. To get a certificate, they talk to one of several servers, which are the 'multiple machines' I mentioned. I first considered putting the CA behind a single http server, but in stress tests have found that generating certs can become a bottleneck. I turned to exporting the CA on a DFS, to which only the servers have access, as a higher-concurrency option. Now I'm looking for something concurrent and robust. – Anand Patil Oct 12 '13 at 17:06

I'd recommend OpenCA PKI. I had a good look around for this sort of thing a while ago, and it's the only thing that fit the bill. I've not been rigorous, but the software seems good; the documentation, however, is sorely lacking. This PDF file should help you get up and running. They also have an OCSP responder you can use (which I haven't yet tried).

I tested this software a while ago, but haven't yet put it in production. You can run PostgreSQL or MySQL, and I believe I'd have been using it with MySQL (my preference) but can't absolutely recall. I stopped using it because I got distracted with other projects, not because the software wasn't working.

I remember being very impressed with OpenCA. (For the record, I'm not affiliated with the project at all.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.