I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I correct?
The setup I was considering was one Root CA and multiple intermediates (for different purposes). So, the root could be a standalone windows standard or Linux + OpenSSL (don't know if this is possible/advisable). One of the intermediate CAs is to be part of the AD (auto-enrollment and such).
So, my questions are:
Can the root be standalone (not part of the AD)? Will this cause any problems with the certificate chain or such?
Can the root be Linux + OpenSSL? Will this be harder to manage?
Or is there a workaround for the tombstone limit?
See :http://blogs.technet.com/b/askds/archive/2009/10/13/designing-and-implementing-a-pki-part-ii.aspx and http://pki-tutorial.readthedocs.org/en/latest/advanced/index.html for references.