Offline root CA and private PKI for air-gapped networks

Cost is driven by the number of people and locations involved, the hardware you buy or rent, and the design work that comes before any key is generated. The main line items are the HSM or hardware key storage for the root and issuing keys, secure enclosures or safes for offline media, the build of one or more online issuing CAs, and the key ceremony itself, including the time of custodians and witnesses. Some costs are one-time, such as the ceremony and initial hierarchy design. Others recur, such as HSM support contracts, CRL and issuing CA operations, and periodic renewal of intermediates. Ask any partner for a quote that separates hardware, licenses, implementation labor, ceremony support and ongoing operations. Ask which parts are fixed scope and which depend on your number of CAs, locations and integrations.

Duration depends on how much of the environment already exists and how many approvals the design needs. A greenfield enclave with its own hardware, a documented hierarchy and an agreed ceremony plan takes far less time than a build that must wait for a new HSM shipment, a security review of the air gap, or a migration from an existing CA. The schedule usually depends on change control windows, the availability of key custodians and witnesses, and how long your organization needs to approve the certificate policy and profiles. No timeline should be accepted until the written scope lists the environments, the number of issuing CAs, the integrations and the ceremony dates. Ask the implementation partner to show which milestones depend on your staff and which depend on hardware delivery.

The client supplies the people, space and approvals that the design cannot supply itself. That includes network owners who document the enclave boundary and transfer paths, key custodians who hold the activation material, independent witnesses who observe and sign the ceremony records, and a change control board that approves each ceremony step. You also need a certificate policy, naming and lifetime rules, a secure room or cabinet for offline media, and a decision on who may request, approve and revoke certificates. Ask the partner to produce a responsibilities matrix before work starts, and confirm that your custodians and witnesses are named, trained and available on the planned dates.

Internal teams can run an offline PKI if they already operate a PKI, have staff trained on HSM administration and key ceremonies, and can keep procedures, logs and evidence consistent over time. The harder part is ongoing discipline rather than the first build: the offline root must be powered up rarely and under controlled conditions, and issuing CA renewals, CRL publication and software updates must follow written runbooks. Many teams split the work, keeping day-to-day issuance in house while using a partner for design, the first ceremony, documentation and periodic reviews. Ask any partner which tasks they would hand over to your team, and whether they offer retainer support for upgrades and testing after the build.

The offline root signs only the intermediate CA certificates, so it is brought online rarely, and the online issuing CAs handle end-entity issuance, renewal and revocation publication. Each issuing CA publishes its own CRL inside the enclave, and clients must be able to reach those distribution points. Renewal of an issuing CA certificate requires a planned ceremony before its expiry, so the calendar for that event should be set long before it is due. In FreeIPA, the first server handles certificate renewal and CRL publication by default, so replicas and backup plans need to account for that role. Ask how the partner tracks intermediate expiry, how CRLs are reachable from every trust zone, and what happens if a CRL is stale.

Updates must be built or downloaded outside the enclave, checked for integrity and authenticity, and then carried across the boundary on approved media. Security Onion supports updates from newer ISO media in airgap mode through its soup tool, and Wazuh publishes an offline installation guide and can use an offline vulnerability repository. For PKI components, check the vendor's offline upgrade path for step-ca, OpenBao or Dogtag before scheduling changes. The NERC CIP-013-2 supply chain control is a useful reference for the verification step, even outside the power sector. Ask the partner for a transfer procedure that covers hash and signature checks, a test environment, rollback steps and the record kept for each package.

It often does. Several open-source and commercial products restrict air-gapped deployment to paid tiers, so the license you choose can decide whether the design works at all. Mattermost lists air-gapped deployment in Enterprise Advanced, Rocket.Chat excludes it from the free Starter plan, and Metabase offers it on its Enterprise plan. For PKI, step-ca is licensed under Apache-2.0, and FreeIPA under GPL-3.0-or-later with no paid edition of its own. Confirm each component's license and offline capability in writing before you commit, because the answer can differ by version and edition.

A well-run ceremony produces records that an assessor can inspect: the certificate policy, the hierarchy diagram, signed ceremony scripts and logs, witness attestations, HSM configuration records, issuance and revocation logs, and CRL publication history. The HIPAA Security Rule at 45 CFR 164.312 and the FTC Safeguards Rule at 16 CFR 314.4 both expect audit controls and access control evidence where sensitive data is involved. DeployOpen prepares these controls and evidence for assessments but does not issue audit reports or certifications; independent auditors do. Ask the partner which artifacts they deliver, and confirm with your assessor which ones they will request.