Yes, creating an internal PKI infrastructure is often very complicated and insecure unless many different issues are understood and handled correctly. One approach for this is to have them put on their laptops (assuming those are stored securely) and have for example their email-clients setup to sign all outgoing mail. You need to deliver the keys of the signed certificates to the correct persons in a secure way and have them use them. Best practice would be to have an automated solution. Else this whole certificate setup would be rather pointless. Your organization should also have procedures in place to make sure people also check signatures and take appropriate action should some signature be missing or not match. There are also some other things you need to be careful of: Using social engineering one could exploit bad procedures. Your organization will need proper procedures to ensure the identities of the individuals requesting signing. This is a big potential weak-point in the certificate chain, if the private key of for example the root certificate is obtained by someone they could impersonate anyone in the organization.Įnsure the identity of the organization/person that is requesting the signing of a certificate. Secure the private key(s) used to sign the certificates. You will need to make sure every computer in your organization has this root certificate. Big CA's have their root certificate shipped with the end-users OS. However a CA needs to do more than just sign certificates:ĭeliver the root certificate to the end-users thrust-store. So from that standpoint there is no disadvantage. Big certificate authorities use the same technology (mathematical principles) for their certificates as you would when using an internal CA.

Jsignpdf set key