Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I correct?

The setup I was considering was one Root CA and multiple intermediates (for different purposes). So, the root could be a standalone windows standard or Linux + OpenSSL (don't know if this is possible/advisable). One of the intermediate CAs is to be part of the AD (auto-enrollment and such).

So, my questions are:

Can the root be standalone (not part of the AD)? Will this cause any problems with the certificate chain or such?

Can the root be Linux + OpenSSL? Will this be harder to manage?

Or is there a workaround for the tombstone limit?

Thanks.

See :http://blogs.technet.com/b/askds/archive/2009/10/13/designing-and-implementing-a-pki-part-ii.aspx[1] and http://pki-tutorial.readthedocs.org/en/latest/advanced/index.html[2] for references.

share|improve this question
1  
Why do you think tombstones would be an issue? A CA should not be a domain controller. –  Zoredache May 2 '13 at 15:31
    
I thought it could apply to CAs. Seems it's only for AD replication purposes. Thanks. –  rebasing May 2 '13 at 15:40
    
@rebasing You should edit your question after such new information. –  Hauke Laging May 2 '13 at 16:15
    
See: serverfault.com/questions/180085/… –  Zoredache May 2 '13 at 16:25

2 Answers 2

up vote 2 down vote accepted

Microsoft specifies that the offline root CA machine should not be a member of a domain, so it's not going to cause you any problems, and it makes the whole issue of AD tombstone lifetime issues moot. To wit:

Set up a server that runs Windows that you will use for the root certification authority. The server should not be a member of any domain, should be disconnected from the network, and should be physically secure.

I haven't attempted extensive interoperability testing with OpenSSL and the Windows CA but, in principle, it should work fine-- it's all standards-based PKI. Certainly, I've signed certs for Windows servers using OpenSSL many, many times w/ no ill effects. As long as you're comfortable using the OpenSSL tools to issue the certs for your second tier CAs it won't cause you any specific management issues.

I see no particular value from deploying the root CA using one set of tools and the intermediate(s) on another. You certainly can, but I don't see how that "buys" you anything.

share|improve this answer
    
Thanks. Excellent answer, covered almost all I needed. And the link is awesome. –  rebasing May 2 '13 at 15:47

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I correct?

Correct. Your offline root CA will be a workgroup computer. You will only turn it on for the purposes of renewing the issuing CA certificates and publishing CRLs. You typically will distribute the root's public key/cert to all of the clients by way of GPO.

The setup I was considering was one Root CA and multiple intermediates (for different purposes). So, the root could be a standalone windows standard or Linux + OpenSSL (don't know if this is possible/advisable). One of the intermediate CAs is to be part of the AD (auto-enrollment and such).

I would not try to mix and match Windows and Linux in a single PKI. There's no benefit to be gained from doing so, and you just make management of the PKI more complex.

share|improve this answer
    
I'd be interested to hear yout thoughts re: a single PKI for multiple operating systems being more complex. Having a single root of trust seems like it would be simpler to deploy than multiple. –  Evan Anderson May 2 '13 at 15:35
    
I wasn't advocating having different root CAs for clients with different OSes on them - I was saying that having a root CA with one OS and an intermediate CA with a different OS adds complexity without much benefit. –  Ryan Ries May 2 '13 at 15:37
    
You can still have a single root of trust... the certificates are standard. I just don't know what the overhead would be. –  rebasing May 2 '13 at 15:38
    
@RyanRies - I see what you're saying. I don't see any particular value coming from mixing an OpenSSL-based CA root with Microsoft intermediates, personally. –  Evan Anderson May 2 '13 at 15:40
    
Licencing and mixed environment ecosystems, mostly, but I wasn't sure if it'd be worth the hassle. –  rebasing May 2 '13 at 15:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.