[Freeipa-devel] Multiple CA certificates in LDAP, questions

[Rob Crittenden]

Jan Cholasta wrote:
> On 9.9.2013 16:02, John Dennis wrote:
>> On 09/09/2013 05:17 AM, Jan Cholasta wrote:
>>> Another question:
>>>
>>> Should each IPA service (LDAP, HTTP, PKINIT) have its own distinctive
>>> set of trusted CAs, or is using one set for everything good enough?
>>> Using distinctive sets would allow granular control over what CA is
>>> trusted for what service (e.g. trust CA1 to issue certificates for LDAP
>>> and HTTP, but trust CA2 only to issue certificates for HTTP), but I'm
>>> not sure how useful that would be in the real world.
>>
>> That would complicate things quickly. Managing CA certs is already
>> challenging enough. Exploding this via combinations does not seem to
>> present enough real value for the complexity.
>>
>> In the real world most deployments boil down to a single CA and that
>> trust model been effective. Don't forget you can always revoke any cert
>> issued by a CA. Having granular control over individual CA's does not
>> seem to present value, just complications. If your CA is compromised
>> you've got big things to worry about, having it be 1 in N does not seem
>> to change that equation radically. If one CA got compromised you've got
>> a lot of work to do to replace the trusted CA list everywhere. If one is
>> compromised why aren't the other CA's? Having to update just one CA
>> trust rather than potentially N is better.
>
> I'm not suggesting *controlling* multiple CAs, but being able to manage
> what individual external CAs are trusted to do. This is probably only
> relevant to CA-less install. When IPA internal CA is installed, there is
> just that one CA, which is trusted for everything.
>

We've fielded questions from people wanting to replace the cert in the 
web server even while maintaining the IPA CA. Granted this was prior to 
the CA-less option.

The impetus seems to be not requiring all users to trust the IPA CA. I 
think if that became easier then wanting to use another CA would be less 
of an issue.

rob