I'm planning to setup two-tier PKI in my environment. We have two remote sites connected via a VPN. I think it is OK to set up both Root CA and Issuing CA on the 1st site.

But, for example, I have internal web server on the 2nd site.

  1. Am I right that, if the VPN fails, clients on the 2nd site still can establish HTTPS connection to the web-server on this site?

  2. Is it a good idea to set up second Issuing CA on the 2nd site? Also, I'm confused how to deal with CDP in this case, because currently I'm planning to create distribution point via web-server on the 1st Issuing CA?

I've used this guide for information purposes.

1 Answer 1


Your CAs are only used to issue the certificates and revocation lists - once issued, the CAs are redundant until such time as you wish to issue more certificates or issue/renew a CRL.

Revocation information, on the other hand, needs to be available 24/7. Some (all?) clients cache the revocation information, which may give you some leeway, but even so, you should consider your CDP up time to be far more significant than your CA up time.

If you are concerned about the reliability of your VPN, then consider running a CDP at either end. Some DNS magic (split DNS?) may allow you to have the URL of your CDP to point to the client's local site regardless of whether it is site 1 or 2.

Therefore, to answer your question:

  1. The clients on the remote site can access a HTTPS website on that remote site only if revocation information is available to the client; assuming the client checks revocation, of course.
  2. While you can place a 2nd CA on the remote site, managing certificates becomes a little harder then. A better plan would be to have a single issuing CA and multiple CDPs. Of course, if your VPN is down more than it is up, then it may be better to consider them as two isolated sites and run a CA and CDP at each.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .