When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate authentication. I am wondering if this is the ONLY certificate authority that the active directory trusts OR if the ROOT CA's specified in Certification Authorities Container ALSO can be used to validate a certificate. Consider this.
I am deploying a Sub CA called SUBCA1 in the NTAuthCertificates which is signed by my ROOT CA called ROOTCA1. My private key for the ROOTCA1 is compromised and the attacker now has the ability to forge a user certificate based upon ROOTCA1. So in this scenario will the fact that I have only published the SUBCA1 to the active directory protect me?
I know you should have a routine implemented for when a Root CA is compromised etc etc but this is totally hypothetical.
This page explains the different containers but I am curious if there is anything behind the scenes that maybe will accept a user certificate signed by the ROOTCA1. https://blogs.technet.microsoft.com/pki/2011/02/28/quick-check-on-adcs-health-using-enterprise-pki-tool-pkiview/