Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 28 / 512

Chapter 1. Overview
8
certificate chains outside the company certificate hierarchy. A Certificate Manager is chained to a third-
party CA by requesting the Certificate Manager's
CA signing certificate
from the third-party CA.
1.2.1.1.3. CA Cloning
Instead of creating a hierarchy of root and subordinate CAs, it is possible to create multiple clones of
a Certificate Manager and configure each clone to issue certificates that fall within a distinct range of
serial numbers. Because clone CAs and original CAs use the same CA signing key and certificate to
sign the certificates they issue, the
issuer name
in all the certificates is the same. Clone CAs and the
original Certificate Managers issue certificates as if they are a single CA. These servers can be placed
on different hosts for high availability failover support. See
Chapter 19, Configuring the Certificate
System for High Availability
for information on configuring clones for failover in a Certificate System
system.
1.2.1.2. Cross-Pair Certificates
It is possible to create a trusted relationship between two separate CAs by issuing and storing cross-
signed certificates between these two CAs. By using cross-signed certificate pairs, certificates issued
outside the organization's PKI can be trusted within the system.
1.2.1.3. Certificate Manager Functionality
The Certificate Manager issues and revokes certificates when it receives signed requests. These
requests can come from its own agents (users who are assigned privileges to approve enrollment
and revocation requests) or from a third-party application that uses its agent certificate (this agent
certificate must be set up for CMC enroll or revoke with the Certificate Manager).
The Certificate Manager also compiles lists of revoked certificates, called certificate revocation lists
(CRLs), that it can publish to files, an LDAP directory, or an OCSP service.
The Certificate Manager maintains a database of issued certificates and processed requests, so that it
can track expiration and revocation.
1.2.1.4. Types of Certificates
Certificate System can issue and manage the following certificates:
• CA signing certificates
• OCSP signing certificates
• Cross-signed pair certificates
• SSL server certificates
• VPN client certificates
• End user certificates
This list is not comprehensive; many other types of certificates can be issued by the Certificate
System.