I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our software). In these cases we have to provide the certificates for them. The customers are completely independent and should NOT be able to communicate with each other, i.e. there should be no SSL trust between Customer I and Customer II. I have a rather general question about how to best built such a CA structure. These are the two variations that are currently considered.
Company Root CA with SubCA for each customer:
Root CA
/ | \
/ | \
Customer I Customer II Customer III
Independent (Root-)CA for each customer:
Customer I Customer II Customer III
What would be the pros and cons of each variant? Is there an established best practice for such a setup?