Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP.
I know the web enrollment can be installed on the Issuing CA as I have it, but what is the best way to handle implementing this in terms of what can be installed together...
Should I move Web Enrollment off and install NDES and it on one server and OCSP on a dedicated?
Should I Keep enrollment on the Iussuing for manual certs and have two more servers for NDES and OCSP or should OCSP always be standalone?
CA- srv1, Issuing with Enroll srv2, NDES/OCSP- srv3
CA- srv1, Issuing- srv2, Web Enroll/NDES- srv3, OCSP- srv4
CA- srv1, Issuing- srv2, Web Enroll/NDES/OCSP- srv3
etc
Does it make sense what I am trying to figour out? Having a hard time finding anything that shows what roles can be installed together and what should always be separate from a best practices standpoint.