Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 139 / 554

Creating a Security Domain
117
Role Description
Enterprise CA Administrators • Automatically approve any sub-CA, server,
and subsystem certificate from any CA in the
domain.
• Register and unregister CA subsystem
information in the security domain.
Enterprise DRM Administrators • Automatically approve any transport, storage,
server, and subsystem certificate from any CA
in the domain.
• Register and unregister DRM subsystem
information in the security domain.
• Push KRA connector information to any CA.
Enterprise OCSP Administrators • Automatically approve any OCSP, server,
and subsystem certificate from any CA in the
domain.
• Register and unregister OCSP subsystem
information in the security domain.
• Push CRL publishing information to any CA.
Enterprise TKS Administrators • Automatically approve any server and
subsystem certificate from any CA in the
domain.
• Register and unregister TKS subsystem
information in the security domain.
Enterprise TPS Administrators • Automatically approve any server and
subsystem certificate from any CA in the
domain.
• Register and unregister TPS subsystem
information in the security domain.
Table 4.1. Security Domain User Roles
As necessary, the security domain administrator can manage access controls on the security domain
and on the individual subsystems. For example, the security domain administrator can restrict access
so that only finance department DRM administrators can set up finance department DRMs.
Enterprise subsystem administrators are given enough privileges to perform operations on the
subsystems in the domain. For example, an enterprise CA administrator has the privileges to have
sub-CA certificates approved automatically during configuration. Alternatively, a security domain
administrator can restrict this right if necessary.
4.4.3. Creating a Security Domain
A security domain can be created during the CA configuration. During CA configuration, the wizard
asks if a security domain should be created. If
Yes
is chosen, then a user-friendly name must be
provided for the security domain. The name is used as the default
Organization
component in the
issuer DN.