Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 118 / 564

Chapter 4. Requesting, Enrolling, and Managing Certificates
96
• Has a trusted CA that is listed in the
CN=Certification Authorities
subtree.
• The last CA in the trust chain must be a self-signed root CA.
4.6.1.2. Planning the Auto Enrollment Configuration
It only requires a single Auto Enrollment Proxy for an entire domain, but it depends on the domain
configuration where and what machine the Auto Enrollment Proxy should be installed on. The proxy
has to be able to authenticate the requester against information in the domain, so the requester must
be in the same forest as the proxy.
Additionally, for security, the proxy should be run on a dedicated machine in a secure environment with
access limited to trusted administrators.
The simplest configuration is to install the proxy as the same machine as the domain controller. This
limits the field of the proxy to that single domain.
Figure 4.3. Having the Proxy on the Domain Controller
Because of traffic or security, it may be better to install the proxy on a dedicated machine within the
domain, but not a domain controller. Depending on the domain configuration, this can also limit the
proxy to entities within the single domain.