Private Key Storage (HSMs)

The CA's private key MUST be protected. Compromise = ability to mint any cert. Industry standard:

Hardware Security Modules (HSMs):

• Physical device that holds the key. Operations (sign, decrypt) happen INSIDE the HSM.
• Key never leaves. Tamper-evident enclosure (epoxy potting, mesh sensors).
• Certifications: FIPS 140-2 Level 3 or 4, Common Criteria EAL4+.
• Vendors: Thales, AWS CloudHSM, Azure HSM, YubiHSM, SafeNet.

Cost: ~$10k-$50k per device. Operationally: rack-mounted in a secure data center.

Air-gap + ceremonies:

• Root CA HSM is OFFLINE. Only powered up for periodic signing ceremonies (sign new intermediates).
• Multi-person physical access: M-of-N keys to unlock the HSM.
• Recorded ceremonies (auditable).

Key generation:

• Inside the HSM. The private key bytes never exist outside.
• HSM exports only the public key.

Signing requests:

• Online intermediate CA (also HSM-backed) handles routine signing.
• Online HSMs are network-attached but isolated.

Backup:

• Encrypted backup to multiple HSMs. Backup encrypted with another key (the "Wrapping Key").
• Geographically diverse backup sites (datacenter loss = catastrophic for CA).

Key rotation:

• Roots: every 5-10 years. Plan for 5+ years of overlap before old root expires.
• Intermediates: every 1-3 years. Old intermediate continues signing existing certs until expiry.

When HSMs are wrong: ICOs, internal CAs that just need protected keys for a year. Software keystores with disk encryption suffice.

When HSMs are right: anything trusted by the public. Browser CAs absolutely need HSM-backed roots. Compliance often mandates it (PCI DSS, FedRAMP).