Mastering Active Directory - Second Edition

Three-tier models

The three-tier model is the most advanced model in the list, and it operates with greater security, scalability, and control. Similar to a two-tier model, it also has an offline root CA and online issuing CAs. In addition to that, there are offline intermediate CAs, which operate between the root and subordinate CAs. The role of the intermediate CAs is to operate as policy CAs. In larger organizations, different departments, different sites, and different operation units can have different certificate requirements. As an example, a certificate issued to a perimeter network will require a manual approval process, while users in the corporate network will prefer auto approval. IT teams prefer to have large keys and advanced ...