Domain Environment + Certificate Authority + Server 2008 R2
Posted
by
user1110302
on Server Fault
See other posts from Server Fault
or by user1110302
Published on 2012-06-01T03:25:21Z
Indexed on
2012/06/01
4:42 UTC
Read the original article
Hit count: 546
I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the best practices are for going about this task, and have decided that in an ideal CA environment you should have one “offline” Root CA, and then two subordinate CAs for redundancy/issuing the certs. That is all good, I understand how this works and why, but in messing with a sandbox I have setup, the way you go about adding certificate authorities to a domain environment seems extremely trivial and against all of their best practices…
Dooes anyone know what the purpose is of an Enterprise Root CA that is integrated into Active Directory? From what I have read, once you setup an Enterprise Root CA that is integrated into Active Directory, it stays with Active Directory for the long haul and must not be turned off/renamed/touched under any circumstances. If this is true, that seems to go against the practice of setting up a standalone root CA, adding the subordinates, and then taking the root offline.
Thanks for any feedback you may have to offer!
© Server Fault or respective owner