Adding OCSP and NDES into existing environment? What can be installed together?

Question

Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP.

I know the web enrollment can be installed on the Issuing CA as I have it, but what is the best way to handle implementing this in terms of what can be installed together...

Should I move Web Enrollment off and install NDES and it on one server and OCSP on a dedicated?

Should I Keep enrollment on the Iussuing for manual certs and have two more servers for NDES and OCSP or should OCSP always be standalone?

CA- srv1, Issuing with Enroll srv2, NDES/OCSP- srv3

CA- srv1, Issuing- srv2, Web Enroll/NDES- srv3, OCSP- srv4

CA- srv1, Issuing- srv2, Web Enroll/NDES/OCSP- srv3

etc

Does it make sense what I am trying to figour out? Having a hard time finding anything that shows what roles can be installed together and what should always be separate from a best practices standpoint.

Answer 1

This might be off topic because it's kind of a capacity planning question, but how you set this up depends largely on how heavily it will be used. Since you only plan on having a single issuing CA, it is probably not going to be too heavily used I hope. You can set everything up on a single machine if you want, so that sort of answers your question. But would you really want to? That's a different question. Why would you want to set everything up on a single server? For instance, the Online Responder is meant especially for devices that can't reach the CA (where the CRL Distribution Point lives) in order to check for certificate revocation... so there's no point in putting it on the same server. Or if you have a huge network and you want to distribute the load of CRL checking, but since you only have a single issuing CA that's doubtful.