Where Your Internal CA and Code-Signing Keys Should Live

Where is your internal root CA key right now? In many infrastructure reviews nobody can answer that precisely. In one of them, the root key sat as a .pfx file on a VM backup share, and the code-signing key for in-house software lived on the build server's disk. Anyone who reached that server could sign binaries in the organization's name.

This week's eMudhra incident, where eight intermediate CAs with weakly generated keys were pulled from browser and Windows trust lists, is a reminder that a certificate is only as trustworthy as the protection of its private key.

A three-layer internal PKI

• Offline root: the root server stays powered off and disconnected; its key is generated inside a hardware security module (HSM) and used only in a documented key ceremony.
• Issuing CA on a network HSM: AD CS talks to the HSM through a KSP/CNG provider, so the key never leaves the device. Two units in HA keep issuance running.
• Separation of duties: CA admin, HSM admin and auditor are different people, and sensitive operations need an M-of-N quorum.

Code signing and short-lived certificates

Since June 2023, publicly trusted code-signing keys must live in hardware rated at least FIPS 140-2 Level 2. The same logic is worth applying to internal keys: the build server sends only a file hash for signing, and every signature is logged centrally.

Public TLS certificate lifetimes dropped to 200 days this year, fall to 100 days in 2027 and reach 47 days in 2029. Two things to start now:

• Centralize TLS termination on a load balancer or ADC, so fewer machines hold private keys.
• Automate issuance and renewal with AD CS autoenrollment internally and ACME for public services.

A simple drill

Once a year, assume your issuing CA key has leaked. How long do revocation, reissuance and the CRL update take? The answer is your real readiness level.

The full guide covers five key groups to inventory, HSM selection criteria, four common mistakes and an eight-step checklist: Internal PKI and code-signing keys in an HSM

— Kazem Mortazavi, independent network-security consultant