Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 31 / 840

Features
Chapter 1 Overview 31
Root or Subordinate CA
CS can function as a root CA ; in this case, the server signs its own CA signing certificate as
well as other CA signing certificates, enabling you to create your own CA hierarchy. You
can also install the server to function as a
subordinate CA ; in this case, the server gets its
CA signing key signed by another CA in an existing CA hierarchy. See “Self-Signed Root
vs. Subordinate CA,” on page 78 for complete details.
Linked CA
CS can function as a linked CA , chaining up to many third-party or public CAs for
validation; this provides cross-company trust, so applications can verify certificate chains
outside the company certificate hierarchy. You chain a Certificate Manager to a third-party
CA by requesting the Certificate Manager’s
CA signing certificate from the third-party CA.
CA Cloning
If you don’t want to create a CA hierarchy comprising root and subordinate CAs, you can
create multiple clones of a Certificate Manager and configure each clone to issue
certificates that fall within a distinct range of serial numbers. Because clone CAs and
original CAs use the same CA signing key and certificate to sign the certificates they issue,
the
issuer name in all the certificates will be the same. Clone CAs and the original
Certificate Managers they are based on issue certificates as if they are a single CA, and can
be placed on different hosts for high availability failover support. See “Cloning a CA,” on
page 127 for details. Also see Appendix , “” for information on configuring clones for
failover in a CS system.
Interfaces
Each of the subsystems contains interfaces allowing interaction with various portions of the
subsystem. All four subsystems share a common administrative interface. All four
subsystems have an agent interface specific to that subsystem allowing agents to perform
the tasks assigned to them. A Certificate Manager and a Registration Manager have an
end-entity services interface allowing end-entities to enroll in the PKI.
Logging
CS produces extensive logs that record system events and errors. Logs are configurable,
allowing you to create logs for specific types of events, and for the logging level you desire.
See “Logs,” on page 255 for complete details.