====== Vzpostavitev PKI-infrastrukture ======

Kompaktna navodila za vzpostavitev PQ-zmožne PKI. → **Podrobnosti:** [[..:pki:start|PKI-scenariji]]

----

===== Hierarhija =====

<code>
Root-CA (Offline, ML-DSA-87)
    └── Intermediate-CA (Online, ML-DSA-65)
            ├── Strežniški certifikati (hibridno: ECDSA + ML-DSA)
            ├── Odjemalski certifikati (ML-DSA-65)
            └── Uporabniški certifikati (ML-DSA-65)
</code>

----

===== 1. Root-CA =====

<code csharp>
using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa87);

var rootDn = new X500DistinguishedNameBuilder();
rootDn.AddCommonName("WvdS Root CA");
rootDn.AddOrganizationName("EMSR DATA d.o.o.");

var request = new CertificateRequest(rootDn.Build(), mlDsa, HashAlgorithmName.SHA512);

request.CertificateExtensions.Add(
    new X509BasicConstraintsExtension(true, true, 2, true));
request.CertificateExtensions.Add(
    new X509KeyUsageExtension(
        X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));

var rootCert = request.CreateSelfSigned(
    DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(20));

File.WriteAllBytes("root-ca.pfx", rootCert.Export(X509ContentType.Pfx, "geslo"));
</code>

→ **Podrobnosti:** [[..:pki:root_ca_erstellen|Ustvarjanje Root-CA]]

----

===== 2. Intermediate-CA =====

<code csharp>
var rootCert = new X509Certificate2("root-ca.pfx", "geslo");
using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);

var dn = new X500DistinguishedNameBuilder();
dn.AddCommonName("WvdS Intermediate CA");

var csr = new CertificateRequest(dn.Build(), mlDsa, HashAlgorithmName.SHA384);
csr.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, true, 0, true));
csr.CertificateExtensions.Add(
    new X509KeyUsageExtension(
        X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));

var serial = new byte[20];
RandomNumberGenerator.Fill(serial);
serial[0] &= 0x7F;

var intCert = csr.Create(rootCert, DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddYears(10), serial);
</code>

→ **Podrobnosti:** [[..:pki:intermediate_ca_erstellen|Ustvarjanje Intermediate-CA]]

----

===== 3. Shramba zaupanja =====

<code csharp>
var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadWrite);
store.Add(new X509Certificate2("root-ca.crt"));
store.Close();
</code>

→ **Podrobnosti:** [[..:pki:trust_store_konfigurieren|Konfiguracija shrambe zaupanja]]

----

===== Priporočila =====

^  Komponenta  ^  Algoritem  ^  Veljavnost  ^
| Root-CA | ML-DSA-87 | 20-30 let |
| Intermediate-CA | ML-DSA-65 | 5-10 let |
| End-Entity | Hibridno ali ML-DSA-65 | 1-2 leti |

----

<< [[.:start|← Kratka referenca]] | [[..:pki:start|→ PKI-scenariji (podrobnosti)]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>kurzreferenz pki root-ca intermediate-ca}}