Ssl – Apache and mod_ssl working with multiple remote CA for client certs

It depends on what you are asking for exactly. If you want the ability to create and revoke your own certs that are trusted by browsers (that is, from an established CA) then you should look for a provider that gives you managed PKI access. I know that both Thawte and Verisign provide this.

If you want to create certififcates for others to use that are chained to a trusted CA, there are some providers that do this, but it costs a LOT.

If, on the other hand, you want to create certs for your own internal use and want to create your own CA that you import into your browser manually, you can accomplish this using just OpenSSL.

Lets review Public Key Infrastructure basics first in a hierarchical PKI model.

1. A public key is an encryptor/locker, and embedded into a certificate created by a certificate authority.
2. A private key is a decryptor/unlocker used in conjunction with a public key.
3. Public keys, and certificates have no confidentiality requirements.
4. Private keys have confidentiality requirements

Therefore, your concern with Apache should be around the private key, not the public key. The typical way a security engineer might protect a private key is to use a hardware security module. A hardware security module (HSM) can come in many form factors including a smartcard, a PCIe card, a PCI card, a USB dongle, a USB stick, a network based HSM, or others. Accordingly, these can cover a large amount of budgets and security capabilities.

There are some HSMs that have validated security implementations such as FIPS 140-2 in levels 1 (software generally) 2 physical (tamper resistance) 3 physical (tamper resistance & intrusion response) and 4 physical (tamper resistance, intrusion response and key zeroization).

To evaluate if your business should do something, I'd look at doing a cost benefit analysis & a risk assessment that includes ALE, ARO, and SLE calculations. However, if you are doing business over the web, it might be better to bring in a web security professional to evaluate all of your infrastructure and come up with a consolidated list of vulnerabilities and weaknesses, with a prioritized remediation plan that you can work with your management.