PKI infrastructure

Question

I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains. I would like to be able to delegate the administration between several administrators corresponding to the subdomains and trusted domains. Would the appropriate implementation for this environment be a root CA (enterprise) and then a subordinate CA for each domain? Would it be necessary a server for each subordinate CA?

In the case of an implementation with only one root CA (without subordinate CA), would it be possible to give permissions to local administrators so that they can only issue certificates for their domains?

Answer 1

Hello there,

The only problem you may have in multi-forest environments -- CDP/AIA URL reachability from each forest. The problem is greatly reduced if you do not use LDAP URLs in CDP/AIA extension for all CAs in the chain. In this case, you don't need to configure certutil -setreg ca\DSConfigDN entry. It won't be used.

What you will need -- is a shared HTTP web server where your root CA will host its CRT/CRL files. This HTTP endpoint must be reachable from both forests.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--