Failover Issuer CAs without Clustering

Posted by James Santiago on Server Fault See other posts from Server Fault or by James Santiago
Published on 2012-11-19T01:36:09Z Indexed on 2012/11/19 5:04 UTC
Read the original article Hit count: 472

Filed under:

failover

|

certificate-authority

|

ad-certificate-services

I am attempting to setup a Certificate Authority with some failover capabilities for the issuer CAs. I have an offline root CA and am attempting to setup two subordinate CAs on our domain which will handle issuing certificates. I'm trying to determine the architecture needed for these two CAs to allow one to go down and the other to take over without the use of failover clustering, as the two are in different geographic locales. Are there documents regarding this setup?

© Server Fault or respective owner

Related posts about failover

SQL Server 2012 - AlwaysOn

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Ich war nicht nur irritiert, ich war sogar regelrecht schockiert - und für einen kurzen Moment sprachlos (was nur selten der Fall ist). Gerade eben hatte mich jemand gefragt "Wann Oracle denn etwas Vergleichbares wie AlwaysOn bieten würde - und ob überhaupt?" War ich hier im falschen… >>> More
Secondary DHCP server won't start on Centos 6.2

as seen on Server Fault - Search for 'Server Fault'
I'm trying to create a backup DHCP server. Server times are in sync. Primary server starts fine. Secondary server won't start. Error from /var/log/messages is: Sep 15 14:47:45 stream dhcpd: Copyright 2004-2010 Internet Systems Consortium. Sep 15 14:47:45 stream dhcpd: All rights reserved. Sep… >>> More
Un-failing over a Cisco PIX 515e

as seen on Server Fault - Search for 'Server Fault'
We had a power outage at our data center last week and when our dual PIX 515E running IOS 7.0(8) (configured with a failover cable) came back, they were in a failed over state where the Secondary unit is active and the Primary unit is standby I have tried 'failover reset', 'failover active', and… >>> More
Failover or load balancing configuration on Apple Xserve and Mac OS X Server Snow Leopard (10.6)

as seen on Server Fault - Search for 'Server Fault'
I'm currently installing a number of Apple Xserve boxes running Mac OS X Server (10.6). After poking and prodding for a while I can't find any obvious way, or documentation telling me how, to set up the 2 ethernet ports in a failover or load-balancing configuration. There seems to be an obvious… >>> More
SQL Cluster on Hyper V Failover Cluster

as seen on Server Fault - Search for 'Server Fault'
We have a VM running SQL Server on a 6 node cluster of blades. The VM's data files are stored a SAN attached using a direct iSCSI connection. As this SQL server will be running a number of important databases we're debating whether we should be clustering the SQL Server or will the fact that the… >>> More

Related posts about certificate-authority

Certificate Authority issuing Basic EFS certificates without Autoenroll

as seen on Server Fault - Search for 'Server Fault'
We have observed some puzzling behavior from the CAs we have set up in both the past and present. For some reason unknown to us, it seems that our CAs are randomly issuing "Basic EFS" certificates to our users. This is evident through the "Issued Certificates" log on the CA. I personally set up a… >>> More
Add a custom certificate authority to Ubuntu

as seen on Server Fault - Search for 'Server Fault'
Hello; I have created a custom root certificate authority for an internal network, example.com. Ideally, I would like to be able to deploy the CA certificate associated with this certificate authority to my Linux clients (running Ubuntu 9.04 and CentOS 5.3), such that all of the applications automatically… >>> More
Understanding Security Certificates (and thier pricing)

as seen on Server Fault - Search for 'Server Fault'
I work at a very small company so certificate costs need to be absolutely minimal. However for some applications we do Need to have our customers get that warm fuzzy not-using-a-self-signed certificate feeling. Since creating a "certificate authority" with makecert really just means creating a public/private… >>> More
Install new root certificate authority (CA) in windows

as seen on Super User - Search for 'Super User'
I am trying to use ninite to get my new laptop set up quickly. However when I try to install, windows complains about the CA. The website ninite.com also shows certificate problems. They use a root CA (COMODO Certification Authority) that is not included into windows 7 by default. However I am not… >>> More
Validating SSL clients using a list of authorised certificates instead of a Certificate Authority

as seen on Server Fault - Search for 'Server Fault'
Is it possible to configure Apache (or any other SSL-aware server) to only accept connections from clients presenting a certificate from a pre-defined list? These certificates may be signed by any CA (and may be self-signed). A while back I tried to get client certificate validation working in the… >>> More