You will need simple cross-certification. It is suitable to "friend" two PKIs in a easy and convenient way. Each organization cross-certify other organization and publish cross-certificates within their organization.
- there is no need in bidirectional AD trust (assuming that CRLs are accessible via HTTP, not LDAP)
- CRLs from other organization must be accessbile from your network and vice versa.
Simple cross-certification isn't much scalable. In practice, it will work for no more than 3 fully connected peers. In order to establish a complete trust between all parties, the number of all cross-certificates to be issued is calculated as follows: . In other words, it is a complete graph topology.
When there are 4 or more participants, a number of total issued cross-certificates increases dramatically. This is where CA bridging helps. The graph is transformed into star topology, where Bridge CA is a center of the topology and it is connected to all participants with single edge. The total number of required cross-certificates is calculated as follows:
Each party issue single cross-certificate to Bridge CA and Bridge CA issue back single cross-certificate to each party. When other organization present you their certificate, its chain is looped through Bridge CA cross-certificate and ends up with your own root CA.