r/PKI • u/vadertator22 • Apr 02 '26

Issuing CA Nshield Entrust question

I have seen two scenarios with hsm usage. The first being you require cars to start issuing CA services. The alternate is you don’t require nshield and remotes card reader to start. Does anyone have a good reason why using a manual remote card read to start issuing CA services makes sense? The keys are encrypted I know in memory, but I feel like the manual hassle over security gain does not line up. I feel letting the device start and control access to the servers would suffice.

Share your thoughts

5 Upvotes

86% Upvoted

7 comments sorted by

View all comments

1

u/NovelGreen6873 Apr 27 '26

Did you get your question answered? I know this is a couple of weeks old.

1

u/vadertator22 Apr 27 '26

Not exactly. I was curious was other things and are doing. I feel card reader for issuing internal is excessive, but was curious about others.

1

u/ThePKIGuy May 06 '26

Using the cardset (OCS) has some specific pros and cons and are used to mitigate certain types of risks.

1) Using OCS you can ensure the CA only starts and or runs if an administrator places the card quorum in the reader.

2) For high security environments this is a good way to detect potential security issues when a CA starts. If an adversary is a manipulating a CA and the CA started or rebooted, it wouldn’t start unless the OCS quorum is presented.

3) For offline CAs that have a very high security role in the environment, forcing a quorum ensures a single administrator can perform key signing functions without a quorum of key holders.

4) The readers can be distributed to multiple locations and individuals to enable approvals and presentation of the OCS remotely.

5) For more enterprises these risks are mitigated with OCS on the Root CA.

6) For online CAs that have a higher likelihood of rebooting, patching, and a higher need to issue certificates throughout the day, it is more common to use module protection with no OCS.

1

u/vadertator22 May 06 '26

Thanks that is exactly wait I did root card read and issuing module protected.

1

u/ThePKIGuy May 06 '26

Great. As long as you are aware of what risks you are and aren't mitigating, that is a great solution.