Examining A Simple, Best Practice Ca Hierarchy

By Author: Henry Brown
Total Articles: 58
Comment this article

This example shows how the layers of CA hierarchies should be implemented and specifies two important practices: protecting the root CA and limiting the types of certificates that any CA can issue. It does not, however, provide the information that will help you accomplish that, nor does it inform you of typical CA hierarchy implementation types and when they should be used. Review the guidelines in this lesson to get the full picture.

Guidelines for Protecting the CA Hierarchy Infrastructure

The CA hierarchy computers require CompTIA Security+ above and beyond that of other servers in the network. The root CA requires special protection. The root CA is the seat of all trust in a PKI. This CA issues all other certificates used in the enterprise. If the root CA is compromised, all other certificate usage is suspect. The only method of recovery is to rip and replace—that is, to revoke all certificates produced by the CAs in the hierarchy, remove all CAs in the hierarchy, and start all over again. The root CA therefore requires a higher degree of protection than any device or free practice tests ...
... on the network. To protect the CA infrastructure, follow these guidelines:

Protect the root CA. To do this: a Establish at least a two-tier hierarchy composed of a IT certification and one or more issuing CAs. Figure 2-3 shows a simple two-layer CA hierarchy that can be used to provide protection for the root CA, and hence for the rest of the trust network. The connection between the two CAs illustrates their hierarchical connection; it does not represent a network connection.

This chapter shows you how to configure your Active Directory physical structure by configuring sites and replication. When you are faced with managing a geographically spread out Active Directory infrastructure, you'll need to understand replication. There are two types of replication: intersite and intrasite. Intrasite is the default replication type that occurs as soon as you place the second domain controller in a domain. Intersite replication occurs when you create sites. You use sites to control data replication between domain controllers. To implement a site topology, you'll need to know how to configure sites and intersite replication. To configure intersite replication, you must be familiar with site links and their attributes of cost, frequency, and scheduling. You must know why it's not always necessary to designate a preferred bridgehead server, site link bridges, or connection objects.