<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-pki-infrastructure
description: >-
  Design, deploy, and manage Public Key Infrastructure including root and
  intermediate CAs, certificate lifecycle management, CRL/OCSP responders,
  certificate templates, and automated issuance with step-ca and CFSSL.
domain: cybersecurity
subdomain: cryptography
tags:
  - pki
  - certificate-authority
  - x509
  - step-ca
  - cfssl
  - certificate-lifecycle
  - root-ca
  - intermediate-ca
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1553.004"]
---

# Implementing PKI Infrastructure

## Overview

Public Key Infrastructure provides the trust foundation for TLS, code signing,
email encryption, and device authentication. This skill covers designing
multi-tier CA hierarchies, deploying automated certificate issuance, and
operating PKI securely at scale.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| step-ca | `brew install step` / binary from smallstep.com |
| CFSSL | `go install github.com/cloudflare/cfssl/cmd/cfssl@latest` |
| Python 3.10+ | For agent tooling |

## Key Concepts

### CA Hierarchy Design

```
Offline Root CA (air-gapped, HSM-stored)
  ├── Issuing CA — TLS Certificates
  │     └── Server/client leaf certificates
  ├── Issuing CA — Code Signing
  │     └── Developer signing certificates
  └── Issuing CA — Internal Services
        └── mTLS client certificates
```

### Root CA Creation (Offline)

```bash
# Generate Root CA key (do this on an air-gapped machine)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 \
  -out root-ca-key.pem

# Create self-signed Root CA certificate (20-year validity)
openssl req -new -x509 -key root-ca-key.pem -sha384 \
  -days 7300 -out root-ca.pem \
  -subj "/C=US/O=Example Corp/CN=Example Root CA" \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"
```

### Intermediate CA Creation

```bash
# Generate intermediate key
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 \
  -out intermediate-key.pem

# Create CSR for intermediate
openssl req -new -key intermediate-key.pem -sha384 \
  -out intermediate.csr \
  -subj "/C=US/O=Example Corp/CN=Example Issuing CA"

# Sign intermediate with Root CA
openssl x509 -req -in intermediate.csr -CA root-ca.pem \
  -CAkey root-ca-key.pem -CAcreateserial -sha384 \
  -days 3650 -out intermediate.pem \
  -extfile <(printf "basicConstraints=critical,CA:TRUE,pathlen:0\n\
keyUsage=critical,keyCertSign,cRLSign\n\
authorityInfoAccess=OCSP;URI:http://ocsp.example.com")
```

### Automated Issuance with step-ca

```bash
# Initialize step-ca
step ca init --name "Internal CA" --dns ca.internal \
  --address ":8443" --provisioner admin

# Issue a certificate
step ca certificate app.internal app.pem app-key.pem \
  --provisioner admin --not-after 720h

# Renew a certificate
step ca renew app.pem app-key.pem --force

# Revoke a certificate
step ca revoke --cert app.pem --key app-key.pem
```

### CRL and OCSP

```bash
# Generate a CRL
openssl ca -gencrl -config ca.cnf -out crl.pem

# Run an OCSP responder
openssl ocsp -index index.txt -port 8080 \
  -rsigner ocsp-signer.pem -rkey ocsp-key.pem \
  -CA intermediate.pem -text
```

## Workflow

1. **Design** — Define CA hierarchy, key algorithms, validity periods
2. **Generate Root** — Create root CA offline, store key in HSM or vault
3. **Create Intermediates** — Sign intermediates from root, deploy online
4. **Configure Issuance** — Set up step-ca or CFSSL for automated requests
5. **Distribute Trust** — Push root CA to client trust stores
6. **Operate** — Monitor, renew, revoke, publish CRLs

## Verification

| Check | Method |
|---|---|
| Root CA offline | Root key not on any network-connected system |
| Chain validates | `openssl verify -CAfile root.pem -untrusted intermediate.pem leaf.pem` |
| CRL accessible | CRL distribution point URL returns valid CRL |
| Cert auto-renewal | step-ca `renew` succeeds before expiry |
| Path length enforced | Intermediate has `pathlen:0` constraint |

## References

- [Smallstep step-ca Documentation](https://smallstep.com/docs/step-ca/)
- [CFSSL GitHub Repository](https://github.com/cloudflare/cfssl)
- [NIST SP 800-57 Part 1 — Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
- [RFC 5280 — X.509 PKI](https://datatracker.ietf.org/doc/html/rfc5280)
