pyCA - Overview

This is an overview of the proposed systems architecure for running pyCA. Note that pyCA implements a certificate authority - not a trust center. This means:
No private keys of users are stored by pyCA at any time! The users themselves are responsible for making backup copies of their private keys and certificates!

Systems

Client system

This is the system of the user accessing the PKI services typically running a Mail, WWW and/or LDAP client software. The user creates the key pairs himself and stores his own private keys.

Public server system

The public server system(s) are holding only public certificate data like issued client-/server certificates and certificate revocation lists (CRLs) and are running Internet services like Mail, WWW and/or LDAP to give users access to the certificate data.
No private keys are stored on this system at all. However the systems administrator has to take care about securing this system in the usual manner (firewalls, no other users etc.). The services provided by this system should also be protected by the SSL protocol to ensure some kind of server authentication and integrity.

Private CA system

The private keys of the certificate authority should be hold on a non-networked system which is only accessible by persons authorized to issue certificates (e.g. a notebook put in a safe might be a practical choice). Data exchanged between this system and the public server system is transported with the help of removable media storage devices.
If better support for cryptographic devices is available in OpenSSL it is highly recommended that the private key data is stored e.g. on smart cards.