Configuring Certificate Authority with OpenSSL

Overview

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This guide covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.

Objectives

• Create a Root CA with self-signed certificate
• Create an Intermediate CA signed by the Root CA
• Issue server and client certificates from the Intermediate CA
• Configure Certificate Revocation Lists (CRLs)
• Implement certificate policies and constraints
• Build a complete PKI hierarchy programmatically

Key Concepts

CA Hierarchy

Root CA (offline, air-gapped)
  |
  +-- Intermediate CA (online, operational)
        |
        +-- Server Certificates
        +-- Client Certificates
        +-- Code Signing Certificates

Certificate Extensions

Security Considerations

• Root CA private key must be stored offline (air-gapped HSM)
• Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
• Set path length constraints on intermediate CAs
• Implement certificate policies (OIDs)
• Enable CRL and OCSP for revocation checking
• Audit all certificate issuance operations

Validation Criteria

• [ ] Root CA self-signed certificate is valid
• [ ] Intermediate CA certificate chains to Root CA
• [ ] Issued certificates chain to Intermediate -> Root
• [ ] Path length constraints are enforced
• [ ] CRL is generated and accessible
• [ ] Revoked certificates appear in CRL
• [ ] Certificate policies are correctly embedded

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC6.7 (Restriction on Transmission), CC6.1 (Logical Access)
• ISO 27001: A.10.1 (Cryptographic Controls)
• NIST 800-53: SC-12 (Cryptographic Key Management), SC-13 (Cryptographic Protection), SC-8 (Transmission Confidentiality)
• NIST CSF: PR.DS (Data Security)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add configuring-certificate-authority-with-openssl

# Or load dynamically via MCP
grc.load_skill("configuring-certificate-authority-with-openssl")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.