My textbook for CompTIA Security+ has the following practice question:

In which one of following PKI Trust Models is the root NOT a single point of failure?

  • Single CA
  • Hierarchical CA
  • Online CA
  • Self-signed

Now, I immediately dismissed Single and Hierarchical as wrong. I briefly considered Online, but decided that having the CA accessible would have no effect on the whether it was a single point of failure. Therefore, I finally chose Self-signed, because there's no single point of failure; each machine is its own CA (I overthink things sometimes). It turned out that I was wrong and that Online CA is the correct answer.

Why is that? How does having the root CA be online make it not a single point of failure? Isn't online vs offline tangential to the question of whether the CA is a single point of failure? Is there another meaning for "Online CA" besides having the root be accessible for certificate-related tasks?

  • Some machines store intermediate certs as well as the root ones. Perhaps the certificate chain could still be verified without checking the root?
    – Ahmad
    Mar 3 '20 at 9:35
  • @Ahmad That's what the hierarchical model is. It still depends on having a single root that can be damaged or compromised. Mar 3 '20 at 13:45

The way the question is worded, there is a root. Therefore, you should have dismissed self-signed because there is no root in self-signed. That's the "obviously wrong" option (using the 4-option model of obviously wrong, 2 almost right, and right/more right).

Online CAs include the idea of redundancies and a distributed chain.

  • If a self-signed certificate is not and has no root, then it would be the correct answer, since it is a model in which the root is not a single point of failure. Mar 3 '20 at 12:24
  • @JonathanGiddy that might be a nice semantic game to play, but you can't argue semantics in a multiple-choice exam. The context of the language is that there is a root.
    – schroeder
    Mar 3 '20 at 12:27
  • There's no semantic game in my interpetation - it's as much a game to dismiss self-signed certs because they don't have a root. The textbook question is badly phrased, and the right answer is whatever the tester wants to hear. Hopefully for the OP, the textbook also mentions this specific advantage when describing these models, as that is the only way to determine what is wanted here. Mar 3 '20 at 12:53

The online root cert is in your trusted certificate store. So if the issuing CA cert is trusted by the root then you trust the issuing CA. As such, the Root can be offline and the certificate chain is still trusted

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.