I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an Windows 2008 system with 3 domains/forest (That is one domain per forest) I wish to use certificates within this and belive I should be able to do so with a single self signed offline room.
- ROOT - is the CA = Self Signed Offline Root
- DOM1IntRoot is the CA for the Active directory domain DOM1.A.COM
- DOM2IntRoot is the CA for the Active directory domain DOM2.A.COM
- DOM23IntRoot is the CA for the Active directory domain DOM3.DOM2.A.COM
There are no trusts, no subdomains So what I'd like to do is sign DOM1IntRoot, DOM2IntRoot and DOM3IntRoot with ROOT so that I only need one offline root
So that means I need to install the ROOT CA certificate into each domain - which I think from the Microsoft "Example Scenario for Contoso" means I need to set the LDAP AIA location to a configuration partition which exists in all domains (in this case DC=a,DC=com ) and the HTTP location to some single server . However, it also says that they can have seperated CRL/AIA locations which seems contradictory
So then I read the answer referenced above and says leave the AIA/CRL blank. Which seems to imply that the DOM1IntRoot, DOM2IntRoot , DOM3IntRoot will be publishing the CRL/AIA for the ROOT
So I have two possible answers either the ROOTCA has CRL/AIA or it doesnt. If the ROOTCA has AIA/CRL then what exactly should I specify for the LDAP/HTTP and FILE URLS for AIA and the CRL locations eg is this correct?
ldap:///CN=ROOTCA<CRLNameSuffix>,CN=ROOTCA,CN=CDP,CN=Public Key Services,CN=Services,DC=A,DC=COM http://<SOMESERVER>/CertEnroll/ROOTCA<CRLNameSuffix><DeltaCRLAllowed>.crl file://\\<SOMESERVER>\CertEnroll\ROOTCA<CRLNameSuffix><DeltaCRLAllowed>.crl
<SOMESERVER> is a server with IIS which will make the Certificates abvailable
Note that I am NOT using the offline roots servers name as its never seen- is that correct?
If the ROOTCA does not have AIA/CRL then how do I publish a revocation of (say) DOM1IntRoot?
I'm a little confused so this question may be starting from completely the wrong assumptions
I'll add a little information on the domain structure to try and head off some questions - DOM1.A.COM is where the clients set - DOM2.A.COM is a DMZ type network protecting DOM3 - DOM3.DOM2.A.COM is only accessed but users from DOM1 remotely logging into DOM2 and then another remote session in DOM3 - We wish to use certificates for the seesions between DOM1 and DOM2 and DOM2 and DOM3 - We also will be using certificates from DOM2 to the network devices (It probably should be DOM3 but thats still being discussed) - DOM2 and DOM3 are isloated from the internet. DOM3 is isloated from everything except DOM2