The security of the CA private key guarantees the credibility of a digital certificate and the validity of the signature. In order to enhance the security protection of the CA private key, we distribute the CA private key to t signature servers with (t,n) secret sharing, each having a different private key sharing, and the private key sharing is periodically updated using the proactive secret scheme. A phasebased RSA signature mechanism is used, each server calculating part of the signature, and then the signed proxy gets the final signature. In the whole process, the CA private key never reconstructs, so it strengthens the safety of the CA private key and the signature. Finally, heterogeneous platforms are used to store the CA secret. VC and OPENSSL are adopted to realize it.