If you're going to roll your own CA to secure your infrastructure, get in the habit of also creating your own intermediate authority, esp if you're going to do some minimal client certificates. Then you can keep your root ca offsite and never used. IF your stuff get's compromised, then it's a matter of revoking all of your intermediates certs rather than starting over with a completely new CA.
We have a root ca for everything. Then created an intermediate for the infrastructure (posgtres, etc). We also created an intermediate just the API, from which we issue client certificates for API access.
This is just for securing the connection to allowed users. Once connected via a client cert, they still have to do the proper auth with OAUTH, etc on top of that. Should the intermediate or client certs get compromised, we reissue an API intermediate, and new client certs. All of course, on top of OAUTH revoking, etc.
Comments
If you're going to roll your own CA to secure your infrastructure, get in the habit of also creating your own intermediate authority, esp if you're going to do some minimal client certificates. Then you can keep your root ca offsite and never used. IF your stuff get's compromised, then it's a matter of revoking all of your intermediates certs rather than starting over with a completely new CA.
So for example.
We have a root ca for everything. Then created an intermediate for the infrastructure (posgtres, etc). We also created an intermediate just the API, from which we issue client certificates for API access.
This is just for securing the connection to allowed users. Once connected via a client cert, they still have to do the proper auth with OAUTH, etc on top of that. Should the intermediate or client certs get compromised, we reissue an API intermediate, and new client certs. All of course, on top of OAUTH revoking, etc.
Good call! The more you can use the principle of least-privilege the easier things tend to be in the long run.