0

I'm tasked with implementing a 2 tier PKI (ADCS) with 2 subordinate CA's to provide high availabilty. Now I am wondering if I have 2 suborindates with the same certificate templates active, how will be determined what CA will handle requests. (No load balancers present)

Can I expect an even flow or will 1 CA be used most of the time?

The PKI will be built with Windows Server 2019

Improve this question
2
  • How will you be issuing the certificates? Auto enrollment? Web registration?
    – Lenniey
    Apr 2, 2019 at 9:15
  • Hello, this depends on the certificates. Common certificates will be issued with auto enrollment, however the web enrollment roll will also be setup so It can be used if it where needed. Further more the certificate enrollement wizard wil also be used as a more safe way to add SAN names to web server certificates, as apposed to enabling the flag so this can be done in web enrollment.
    – kevin rennenberg
    Apr 2, 2019 at 11:16

1 Answer 1

Reset to default
2

[MS-WCCE] conforming clients (Windows and some 3rd party tools for other operating systems) select CA randomly. If you have two CAs with the same set of assigned certificate templates, both will have equal chances to get contacted by clients. If client is site-aware, the closest to client CA will be contacted, otherwise, random CA is selected.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.