Podcast
Root Causes 273: A Deep Dive on CA Agnostic


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
January 30, 2023
The industry is seeing more and more attention spent on the idea of CA agnosticism. As with any buzzy technology term, it can be used to mean a variety of things. Join us as we catalog the various ways a Certificate Lifecycle Management (CLM) system can be "CA agnostic."
Podcast Transcript
Lightly edited for flow and brevity.
We are seeing it used in the industry. We are seeing it used by analysts. I know it’s a Gartner term and as always, with tech words, the definition might vary based on who is using it and what they mean. You and I have discussed this with other terms as well and so we were thinking today it would be a good idea to dig into that a little, talk through the idea of CA agnostic, what might that mean or might it not mean and give everybody a framework.
So SSL certificates. which became TLS certificates, which we still use to this day heavily, the ability to put those certificates onto the websites, the ability to manually provision them, manually manage them, this was still a world before certificates were used basically just about everywhere in all kinds of use cases. But let’s stick with this idea of publicly trusted certificates for this particular podcast, Tim, because this is kind of interesting.
So you have these couple of dimensions here, Tim. You’ve got the dimension of many Certificate Authorities, more than one. There are a handful of large ones but there are many Certificate Authorities and then you also have many places where certificates come from even if they are not publicly trusted. On-prem PKI was one of the original places where certificates came from in history.
And then you have all kinds of other places. Now in the public cloud, and we’ll go through that list of all the different places you get your certs from. So when you say “CA agnostic,” where did that come from? It really came from a set of vendors who very early on recognized that certificate lifecycle management was important, and these vendors were not necessarily the Certificate Authorities themselves who are issuing the certificates.
Fast forward to 2021 and all of the sudden we have a CA who is announcing CA agnostic CLM, and that was Sectigo. Then you have to ask, well what does this mean? And I think, Tim, I love the way you brought it up at the beginning of the podcast because it means so many things to so many people and that’s because it is a lot of things. It actually is a lot of things.
Then all of the sudden, Tim, especially with the adoption of things like Let’s Encrypt, you now had enterprises, sometimes even small companies, that were sourcing their certificates from multiple CAs just because. You might have your Tim.com, your main site, right, TimCallan.com, whatever it is, you might have had your branded origin server certificate from a Sectigo and then you might have had a bunch of test subdomains that you were just gonna turn off and on and you were just experimenting and you might have just went off and got yourself an Amazon cert or Let’s Encrypt cert or something like that. But here’s the problem. You didn’t have visibility to it.
Number two, though, is second sourcing – a deliberate second sourcing exercise where you say, you know what, CAs have failed; it doesn’t happen often, but it has happened. There’s no such concept as too big to fail. Symantec failed, right? Therefore, I want to have two vendors and I’m runing 90% of my volume through CA A and I’m running 10% through CA B because that way if there’s ever a problem with CA A, I already know that CA B works, and I just call them and turn up the volume. We see that a lot, too. Under those circumstances it’s pretty rotten if you can’t have your second source sitting inside of your CLM of choice.
Both those scenarios occur on a regular basis, and that’s what you are saying. That’s what CLM vendors including the CLMs that come from CAs, including Sectigo, are trying to address and deal with.
And then the second shade of gray is honestly if you support three or maybe four major public CAs you’ve hit in excess of 98% of the certificate volume. So, if you do that, then do you turn around and say, well, you know what, that’s gonna be good enough for almost everybody or are you that particular enterprise that happens to want that long tail? So again, what does support look like in that regard? Is it good enough for me to have the top two, top three, top four, top five? Or do I think I need the long tail? And that’s another area where it all is a shade of gray and nothing is 100% and there is no all or nothing. It’s all where do you sit on that spectrum.

