<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>You are asking for a full blown PKI and rolling your own is less than prudent for a complex area with a lot of security and availability implications.</div><div><br></div><div>Look at <a href="http://www.openxpki.org/">http://www.openxpki.org/</a></div><div><br></div><div>Regards</div><div>Mark</div><div><br></div><div><br></div><div>On Tue, 2023-03-28 at 19:14 +0530, Newbie User wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div>Hello All,</div><div><br></div><div>I would like to explore OpenSSL more by setting up a PKI environment to test. Please let me know relevant resources that would be helpful in setting up a:</div><div><br></div><div>1) Root CA</div><div>2) Sub-ordinate CA</div><div>3) Clustering of CA for load balancing</div><div>4) Managing the internal DB (if any) by OpenSSL or recommended to use as we need to cleanup MS DBs for CA</div><div>5) Setting up Policy Servers, 3 tier CA hierarchy</div><div>6) Setting up network devices enrollment servers, OCSP servers the way we have in MS PKI</div><div>7) Web Enrollment Servers, CRL Servers setup</div><div>8) Cross forest enrollment, publishing certificate templates</div><div><br></div><div>There are many resources available but need to know the right ones to save time as per experience of other people. Please let me know if you have some tested links to setup these topics as mentioned above<br></div><div><br></div><div>Regards<br></div></div>
</blockquote></body></html>