What are the problems with creating an own CA for intranet?

Question

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet.

Especially:

don't do it. Nope. Bad idea. Buy $10 CA signed certificates instead. Don't be your own CA. No. Nope. Bad idea — KristoferA

But also:

echo "Abandon all hope, ye who enter here." — Tom Leek

Why should one put more trust in an arbitrary CA that sells certificates for $10 than in the company's own IT department?

(I'm even inclined to trust certificates signed by suppliers or clients^{1, 2} more than I would trust certificates signed by the common root CA's.)

• Is keeping the CA server secure the problem?
• Is distributing and installing root certificates the problem?
• Is the RA and/or the distribution of up to date CRLs the problem?
• Is restricting who or what receives a certificate and who or what signs a certificate a problem?
• Any other problems? (Perhaps my limited knowledge, and the limited knowledge of other IT professionals in general, about all essential aspects for a secure CA. Are why KristoferA, Tom Leek, and others strongly advise against «homebrew» CA's.

Probably a professional CA will have more expertise in the first three areas and they could do better than any «smug» who creates his own CA. But still the factor of trust comes to mind especially for the last part.

---

^{1.) Given that my company has a longterm relation with these suppliers and clients.}

^{2.) Restricted to certificates about their own servers and employees.}

Answer 1

There is nothing at all wrong with running your own internal certificate authority; the vast majority of large companies that I have interacted with have their own internal CA.

Advantages

• The nominal cost of a cert becomes nearly zero when amortized over enough systems and users; when you purchase certificates from an external CA, this will never become the case.
• It can be a lot easier to manage certificate expiration and renewal, since you can assign ownership to an internal group, instead of a single user who requested it.
• You can do all sorts of neat things that are very difficult or expensive to do with external CAs, such as creating wildcard certs for subdomains, like *.test.company.com, or creating weird invalid certs for testing purposes (SHA-1 2017, 512-bit RSA, etc.)

Disadvantages

• Running a CA is really hard. For your own internal CA, you obviously don't need to have quite the level of security controls of a real CA, but it's still quite complex.
• The people who are capable of creating and running a CA are certainly not cheap; in the US at least, you can expect that people with strong knowledge of cryptography and/or PKI will be making six figures.
• It's not just enough to have a CA, you also need to build systems around them. Websites/APIs for requesting certs and handling revocations, notification systems for certificate renewal, installation packages to push out root certificates, etc. You could buy a software package that manages a lot of this for you, but that's certainly not free either.

For sufficiently large companies, there becomes a tipping point where the cost of purchasing all these external certificates and the loss of flexibility entailed therein becomes a significant enough issue to create your own CA.

Otherwise, I agree with those who warned you against it: for the vast majority of small to middle-size companies, it's simply not economical to run their own CA; it makes far more sense to simply deal with a company that specializes in the matter. Even a thousand certs at $10 a year is a steal when compared to the cost of setting up a well-run internal CA.

Summary

It's not about trust, it's about cost.