Mastering Active Directory - Second Edition

The CA

CA role service holders are responsible for issuing, storing, managing, and revoking certificates. The PKI setup can have multiple CAs. There are two main types of CA that can be identified in a PKI:

• The root CA: The root CA is the most trusted CA in the PKI environment. A compromised root CA will compromise an entire PKI. Therefore, the security of the root CA is crucial. Best practice is to bring the root CA online only when required. By considering the security and hierarchy of the PKI, it is recommended to use the root CA only to issue certificates to subordinate CAs.

• Subordinate CAs: In PKI, subordinate CAs are responsible for issuing, storing, managing, and revoking certificates for objects or services. Once a CA receives ...