Re: how many CA's (cross posted...)

ok, so i issue a certificate from central, then crl and aia will found
locally trough the local DC because i correctly set "site and service"
applet. correct ?

Perfect.

If there is a problem on the line to-from branch office... wht typi of
result i can have ? I thnk only problem if i need to rennovate a certificate,
so think is better to issue certificate with duration long, something like 30
gg and hope 30th day line is ok. Correct ?

Thanks

Marco


"MarioC" wrote:

Hi there,

Since the CA is only used when issueing certificates it would not make any
sense to install a second one in the branch office. All required information
(CRL, AIA) can be found redundant in AD.

Installing ca CA on a DC is supported. Best practice would be to install the
CA on a dedicated (virtual?) secure machine.

Mario




"Marco Tonoli" <MarcoTonoli@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:AB81E25F-7CE9-4692-AB3E-AE9F7F0F1554@xxxxxxxxxxxxxxxx
Hi all, i have a question:

i have a PKI infrastructure, with a offline root, an enterprise CA and a
domain controller. We use PKI for smart card, email signing and what
future
time will offer...
Now we start a branch office with many user so i make a new domain
controller (for same central domain) in the branch office for
autentication
speed and geographics redundance. The lan's have non egual ip addressment
but
one see each other. I'll correctly set "site and service" applet so pc
remote
will use remote DC.
My question is... i need also a second CA in the branch office ? if not i
can have speed problem ? (i don't kon how fast is connection, specifically
during working hour).

And, if i need a second CA, can install on DC ? (i think have not CPU
power
problem and no security access problem) and there same particolar
procedure
to avoid strange situation like pc autentication or PKI process on erratic
CA
and DC ?

Thanks all in advance (and excuse my english.... writing from italy.)




.

Relevant Pages

  • Re: how many CAs (cross posted...)
    ... I thnk only problem if i need to rennovate a certificate, ... If the line to your branch office goes down nobody could issue or renew new certificates. ... sense to install a second one in the branch office. ... I'll correctly set "site and service" applet so pc ...
    (microsoft.public.windows.server.security)
  • Re: how many CAs (cross posted...)
    ... I thnk only problem if i need to rennovate a certificate, ... If the line to your branch office goes down nobody could issue or renew new certificates. ... sense to install a second one in the branch office. ... I'll correctly set "site and service" applet so pc ...
    (microsoft.public.windows.server.security)
  • RE: CERTIFICATE
    ... If it is correctly set up, the certificate validity should be checked at ... an expired certificate?? ...
    (Security-Basics)