Planning a two tier ADCS PKI infrastructure as follows:
ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int
ORCA is an offline root CA, and
SCA1..SCA3 are subordinate CAs where each subordinate CA belongs to to a completely different domain/forest with no trust or knowledge of one another (
Now bearing in mind this is ADCS the ideal scenario is that the
ORCA is configured with a LDAP URL for CRLs as well as a HTTP URL. Domain clients would then get the
ORCA's CRL from
LDAP and non-domain clients would get it from the HTTP location, presumably a server running IIS or something.
However, this is a problem when multiple completely separate domains all use the same root - when the
ORCA is configured it asks for a distinguished name and any issued CRLs with a LDAP URL in it will contain exactly that distinguished name.
So if we set the
ORCA's DN to
DC=one,DC=int all CRLs issued by
ORCA will contain
LDAP://<lots of stuff that don't matter>,DC=one,DC=int. So now the clients from
three.int would be trying to go over to
one.int to get the CRL from LDAP there - yet they don't even know of the existence of the other domains/forests.
And if we try to take an
ORCA CRL that contains
LDAP://...,Dc=one,DC=int and manually publish it to
two.int ... I'll get an error that
one.int was not found.
We could remove all
LDAP URLs from the
ORCA CRL and only have a HTTP URL there, but the (other) advantage that publishing to LDAP gives is "automatic" redundancy and load balancing (in the sense that you never have a domain with a single DC). Giving a HTTP URL would mean that we would need a web server cluster to ensure high availability at the very least, but it also means a construct would look somewhat like this:
ORCA | IIS CLORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int IIS CL1 IIS CL2 IIS CL3
Where each of the
IIS CLs are IIS clusters:
IIS CLORCA just the CRL for
ORCA (and runs OCSP?),
IIS CL1 hosts the CRL + delta for
SCA1 and runs OCSP, etc etc...
Of course on the side of the
SCA1..SCA3 you could combine the CA role with the IIS role but would you really want to do that? That's a rubbish idea from a security point of view and increases the attack surface of the CA itself.
Of course in this construct each subordinate CA would publish to LDAP, but all of the domains have clients that are not part of the domain either so HTTP URL is required and makes no sense to have a single server serving serving the CRL/delta + OCSP. If that server happens to be offline when a non-domain client tries to validate a certificate - like it will happen at least once a month with Windows Updates -, the client will receive no reply from OSCP nor be able to download a CRL and therefore fail to validate the certificate. Hence the reason for IIS clusters on each individual domain.
Yet ... this feels over the top. I wanted to get people's opinions bearing in mind that the purpose of this is for a production environment.