CA Key Size Too Small

TL;DR

Your Certificate Authority (CA) key is shorter than the certificates it’s issuing. This is a security risk! You need to generate a new, stronger CA key and re-issue all affected certificates. Here’s how.

1. Understand the Problem

Certificates are signed by CAs using their private key. The strength of this private key is crucial for security. If your CA’s key (e.g., 2048 bits) is smaller than the certificates it issues (e.g., 4096 bits), attackers could potentially compromise the CA and forge certificates.

2. Check Your Key Size

1. CA Key Size: Use OpenSSL to check your CA’s private key size.

   openssl rsa -in ca.key -text | grep 'modulus length'

   This will output something like modulus length = 2048.

2. Certificate Key Size: Check the certificates issued by your CA.

   openssl x509 -in certificate.pem -text | grep 'modulus length'

   This will output something like modulus length = 4096.

3. Compare: If the certificate key size is larger than your CA key size, you have a problem!

3. Generate a New Stronger CA Key

We recommend at least a 4096-bit RSA key. Use OpenSSL to generate it.

openssl genrsa -out new_ca.key 4096

This creates a new private key file named new_ca.key.

4. Create a New CA Certificate

1. Create a Configuration File: You’ll need a configuration file (e.g., ca.cnf) for the new certificate. A basic example:

   [req]
    distinguished_name = req_distinguished_name
    [req_distinguished_name]
    C  = UK
    ST = England
    L  = London
    O  = My Organisation
    OU = IT Department
    CN = My Root CA

2. Sign the Certificate: Use OpenSSL to sign the new certificate.

   openssl req -new -x509 -days 3650 -key new_ca.key -out new_ca.pem -config ca.cnf

   This creates a new CA certificate file named new_ca.pem, valid for 10 years (3650 days). Adjust the validity period as needed.

5. Re-issue Affected Certificates

For every certificate issued with the old CA key, you need to re-issue it using the new CA key.

1. Create a Certificate Signing Request (CSR): For each server/service needing a certificate, create a CSR.

   openssl req -new -key server.key -out server.csr -config ca.cnf

2. Sign the CSR with the New CA: Use OpenSSL to sign the CSR with your new CA key and certificate.

   openssl x509 -req -in server.csr -CA new_ca.pem -CAkey new_ca.key -CAcreateserial -out server.pem -days 365

   This creates a new signed certificate file named server.pem, valid for one year (365 days).

3. Repeat: Repeat steps 5.1 and 5.2 for all affected certificates.

6. Update Your Systems

Replace the old certificates with the newly re-issued certificates on all servers, services, and clients that use them.

7. Revoke Old Certificates (Important!)

Revoke the old certificates issued by the compromised CA key. This prevents attackers from using them if they somehow obtain copies. How you do this depends on your CA software; consult its documentation for revocation procedures (e.g., creating a Certificate Revocation List – CRL).

8. Secure Your New CA Key

Protect the new_ca.key file with extreme care! Store it securely, restrict access, and consider using a Hardware Security Module (HSM) for added protection.