Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 138 / 554

Chapter 4. Certificate Manager
116
<CAList>
<CA>
<SubsystemName>rhpki-ca</SubsystemName>
<Host>server.example.com</Host>
<SecurePort>9543</SecurePort>
<DomainManager>true</DomainManager>
<Clone>false</Clone>
</CA>
<SubsystemCount>1</SubsystemCount>
</CAList>
</DomainInfo>
The URL to the CA uniquely identifies the security domain. The security domain is also given a friendly
name, such as
Example Corp Intranet PKI
. All other subsystems -- DRM, TPS, TKS, OCSP,
and other CAs -- must become members of the security domain by supplying the security domain URL
when configuring the subsystem.
The registration involves adding the following information to the security domain's subsystem registry
file,
domain.xml
:
• A user-friendly name such as
Employee Certificate Authority
• A service URL
• The type of subsystem, either CA, OCSP, DRM, TKS, or TPS
Each subsystem within the security domain shares the same trust policies and trusted roots which can
be retrieved from different servers and browsers.
The information available in the security domain is used during configuration of a new subsystem,
which makes the configuration process streamlined and automated. For example, when a TPS needs
to connect to a CA, it can consult the security domain to get a list of available CAs.
A subsystem retrieves information in the security domain through XML messages over HTTPS.
The subsystem authenticates to the security domain using a subsystem certificate. To issue a
certificate automatically during configuration, a security domain administrator must authenticate to
the security domain using a UID and password. More information on security domain roles is given in
Section 4.4.2, “Security Domain Roles”
.
4.4.2. Security Domain Roles
The security domain allows the roles defined in
Table 4.1, “Security Domain User Roles”
.
Role Description
Security Domain Administrators • Add and modify users in the security domain's
user and group database.
• Manage the shared trust policies.
• Manage the access controls on the domain
services.
By default, the CA administrator of the CA
hosting the domain is assigned as the security
domain administrator.