To harden your CAs, perform thorough security audits regularly—particularly before and after making any major changes to your CAs. As you conduct such audits, watch for anything that could potentially affect your CAs’ integrity. For example, you should check to make sure that no unauthorized person has been granted permissions to change a root-level CA linked to a subordinate CA. (If you’ve implemented auditing, this information will appear in the Security log.)
You can also help secure your CAs if you remember that the more code you have on a system, the more likely it is that someone will exploit that code. Make sure that no one installs applications on your CA servers, and disable any unused services—especially any Microsoft IIS services—that you don’t use. Also, configure your security policies to specifically deny access to your CAs to everyone who doesn’t require it.
Backing Up Your Certificate Databases
By far the most important way to protect your CAs is to guard your certificate databases against failure. Safeguarding these databases is particularly important because if something were to happen to your server’s certificate databases, you’d have to create a new CA database and reissue existing certificates. . . .
Register
