Comparing certificate management tools

Contents
Which SSL certificate do I need?
Tasks of digital certificates
Why certificate management?
Possible sources of error and risk factors
Advantages of certificate management tools
What should be considered when choosing a certificate management tool?
How do you go about finding the right tool?
For whom are free tools suitable?
Who needs a professional tool?
Why do I have to pay for professional tools?
What are the arguments in favour of essendi xc?

Which SSL certificate do I need?

Certificates are issued by a trustworthy authority, the certification authority (CA). For this purpose, they are signed with the private key of the CA.
There are different types of SSL certificates, they cost differently depending on their characteristics.

• DV certificates (Domain Validation)
  These are the most commonly used SSL certificates. They can be obtained from various certification authorities, including Let’s Encrypt. Before the certificate is issued, a machine checks whether the DNS entry of the website is actually in the name of the applicant. The identity of the owner is thus checked.

• OV certificates (Organisation Validation)
  Organisation-validated certificates represent the next highest security level. In addition to the domain, an identity check is carried out. For this purpose, a register entry (e.g. from the commercial or association register) and contact details must often be submitted.

• EV Certificates (Extended Validation)
  Especially large organisations with high security requirements use EV SSL certificates with extended validation. It offers the highest level of security through a multi-stage identity check. This is particularly important for large web shops or banks. Since various documents have to be presented, validation can take up to two weeks.

• S/MIME certificates (e-mail validated certificates)
  An S/MIME certificate (Secure/Multipurpose Internet Mail Extensions) is used to encrypt and sign e-mails. The key pair it contains is used for asymmetric encryption.
  The private key always remains with the certificate holder, the public key is communicated to the communication partners. Outgoing mails are encrypted with the private key. Incoming mails that have been encrypted by the sender with the public key are decoded with the private key.
  Special feature: If the private key is located directly in the mail programme (and not on a gateway server), encryption takes place end-to-end. This ensures the highest level of confidentiality.

• Wildcard certificates
  A wildcard certificate protects not only the main domain, but also subdomains. Subdomains can be recognised by a dot in front of the domain name. For example, xc.essendi.de is a subdomain of essendi.de.

• Root certificates
  A root certificate is signed directly by the certification authority. They are therefore also called self-signed.

Tasks of digital certificates

A distinction is made between authentication and infrastructure certificates for different areas of application. There are certainly more use cases than the following examples.

• E-mail signatures
  E-mails are usually signed using S/MIME certificates. This protects the messages from access by third parties. At the same time, the senders can be clearly verified.

• Electronic signatures / electronic seals
  Electronic signatures and seals belong to the category of electronic trust services. The Trust Services Act (formerly: Signature Act) distinguishes between two types of trust services.
  Qualified electronic signatures for natural persons can replace analogue signatures. They are always used when mobile and yet legally secure signatures are required (e.g. when terminating a contract).
  Electronic seals for legal persons correspond roughly to the stamp of a company or a public authority. They can be found as digital proof of authenticity, e.g. under official notices.

• Electronic time stamps
  Qualified electronic time stamps can be used to sign documents that must be issued on a certain date or at a certain time. This is the case, for example, for the timely submission of bids in tenders.

All these trust services are issued by qualified trust service providers such as Deutsche Telekom.

• Securing websites
  Websites are protected with SSL/TLS certificates. This can be recognised by the closed lock symbol in the browser line. Data that is entered into a web form on the site in the case of an order is transmitted in encrypted form. As the domain owner, you must regularly renew the website certificate before it expires.

• System authentication
  System authentication uses certificates to identify a user, computer or device. Without a matching certificate, no access is granted to devices, networks, VPN or applications (even on partner systems). Certificate-based authentication can be used for all endpoints, whether for people, computers or IoT devices.

• Machine communication (M2M communication)
  If devices are to communicate with each other, they must be equipped with corresponding machine certificates. They provide each machine with a unique identity. With this, it can identify itself to other machine or personal identities and systems in the network.
  This ensures that only authorised machines can access certain data. At the same time, communication between the machines is protected.

Why certificate management?

Digital certificates always contain the name and the public key of the owner. This makes it possible to uniquely identify the owner. Certificates are therefore an essential building block for trust on the internet. However, since they only have a limited validity, they must be closely monitored.
The more certificates there are in a network, the more difficult it is to monitor them manually.
Identities are defined by the keys anchored in the certificates. They can also be used to control authorisations and access to sensitive data. Careful certificate management is therefore also important in order to keep an eye on certificate-dependent authorisations and to be able to change them if necessary.

In large companies, there are often several thousand certificates in use. They all have to be kept in view and renewed in time. Critical infrastructure companies in particular must therefore rely on reliable tools. Such a tool can help minimise errors in the entire certificate life cycle.

Possible sources of error and risk factors

Incorrectly configured certificate
When applying for a certificate, sufficient key lengths, internal compliance specifications and requirements on the part of the CA must be taken into account. If the latter are not observed, the application can be rejected by the CA. Delays may occur due to the necessary reapplication.

Incorrectly installed / uninstalled certificate
Certificates are not always distributed cleanly to the target devices. It can happen that a certificate was requested but not installed or installed on the wrong device.

Incorrectly requested certificate
Especially when certificates are not applied for automatically according to defined specifications, errors can occur during the application process. If authorisation is controlled via certificates, users may be assigned rights that are too extensive or too severely restricted.

Undetected certificates in the network
Some devices or applications bring their own certificates into the network unnoticed. You only notice that they have expired when the device or application no longer functions. Often, however, the cause of the error must first be searched for.

In all the cases mentioned above, communication may no longer be established. Processes come to a standstill. This can lead to financial losses and loss of reputation. Therefore, certificate management is an absolutely necessary task.

Advantages of certificate management tools

No system failures due to expired certificates
Probably the most important advantage is that certificate management tools prevent unnoticed expired certificates and thus system failures.

Time savings
Automated tools take over many steps of certificate management. This relieves IT security administrators. Their working time is freed up for other tasks.

Centralisation
Certificate management centrally from one point simplifies processes.

Standardisation
Clearly defined application processes and standardised user profiles (roles) minimise sources of error and thus the risk of incorrectly applied for certificates.

Reporting
Management reports provide a concentrated overview of the certificate inventory. Some tools also offer special compliance reports for audits.

Altering
Some tools warn when certificates are about to expire, reminding users to reapply and install them in good time.

Enhanced security
Defined application processes and authorisations, compliance requirements and installation routines minimise sources of error. This ensures a secure network.

What should be considered when choosing a certificate management tool?

If you decide to use a tool-supported certificate management, you should pay attention to the following points:

How do you find the right tool?

Even before you start looking for possible certificate management tools, you should carry out a needs and requirements analysis. In order to avoid a potentially costly switch to a larger tool later on, one should take the time to carefully define must and can criteria. Some examples are:

• Which use cases exist in the company?
• Which ones absolutely have to be covered?
• Which ones can be automated with existing tools (e.g. Microsoft PKI / MS PKI)?
• How many users need to access the tool? Only 5 admins or 30,000 end users?
• What are the industry-specific requirements for operation and access?
• Do certain compliance requirements have to be observed?
• How much has the number of required certificates grown in the past? Based on this, the likely number needed in the future should be estimated.

We have provided a comprehensive list of selection criteria for you to download free of charge.

For whom are free tools suitable?

For private users and companies that only need to manage a handful of certificates, “manual monitoring” with spreadsheets and calendar entries is often sufficient. In the spreadsheet, the framework data such as issuing CA, place of use and required characteristics are recorded. An appointment entry in the calendar reminds of the timely renewal.

As the complexity of the network increases, so do the requirements for certificate management. Particularly in the open source area, there are a number of free tools that offer a little more comfort than table and calendar.

Certificate management with spreadsheet and calendar

Disadvantages of free tools

Free tools are therefore less suitable for very complex infrastructures. On the one hand, the decision depends on the complexity of the use cases and the certificate volume. In a closed framework, an MS PKI works and you don’t need a big tool.
On the other hand, they require corresponding prior knowledge or familiarisation with the topic. If neither is available, the corresponding maintenance costs should be taken into account.

Certificate management with open source tools or free basic tools

Who needs a professional tool?

Companies that use a large number of certificates need a professional certificate management tool for volume and mass handling. Not only the quantity of certificates is important, but also how many users, peripheral systems and target devices have to be supplied. In addition, the following and (depending on the company) other questions should be asked:

Do expired certificates threaten the failure of critical processes?
If critical company processes or production are affected by an expired or faulty certificate, it must be possible to monitor it continuously.

How high is the level of protection / compliance?
How interesting is the company data or customer data stored in the company for potential attackers? The higher the level of protection, the stricter the crypto guidelines should be.

What risks does a process failure represent?
Does a process failure possibly mean that important applications cannot be made available (stock exchange trading platforms, ATMs, power supply, …)?

How is the availability of applications ensured?
The fact that an infrastructure runs cleanly can only be guaranteed via a tool containing an SLA. This agreement regulates, among other things, to what extent and how quickly support is available. With an SLA, both sides can be sure to have a reliable partner at their side.

Certificate management with fee-based tools

Why are professional tools fee-based?

Professional certificate management tools require a great deal of development and know-how. Since they have to be precisely tailored to the respective company, you receive extensive support during their introduction. And because they manage cryptographic material, they must always be up to date with the latest security standards. Releases are developed regularly for this purpose.
For these reasons, setup and other running costs are incurred in addition to the licence fees for the software.
Nevertheless, it is worthwhile weighing up whether to develop such a tool yourself or to fall back on a ready-made application that can be adapted exactly to one’s own requirements with add-ons.

What are the arguments in favour of essendi xc?

In addition to the advantages mentioned above, xc offers the following benefits:

You can achieve even more security with optional add-on modules such as essendi cd (extended certificate scan). The tool also finds certificates that have entered the network unnoticed. It includes these in the administration and alerting.
Interested? Simply contact us!