Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 483 / 512

How CA Certificates Establish Trust
463
organizational units may have different profile requirements; or a CA may need to be physically
located in the same geographic area as the people to whom it is issuing certificates.
These certificate-issuing responsibilities can be divided among subordinate CAs. The X.509 standard
includes a model for setting up a hierarchy of CAs, shown in
Figure B.6, “Example of a Hierarchy of
Certificate Authorities”
.
Figure B.6. Example of a Hierarchy of Certificate Authorities
The root CA is at the top of the hierarchy. The root CA's certificate is a
self-signed certificate
; that
is, the certificate is digitally signed by the same entity that the certificate identifies. The CAs that
are directly subordinate to the root CA have CA certificates signed by the root CA. CAs under the
subordinate CAs in the hierarchy have their CA certificates signed by the higher-level subordinate
CAs.
Organizations have a great deal of flexibility in how CA hierarchies are set up;
Figure B.6, “Example of
a Hierarchy of Certificate Authorities”
shows just one example.
B.4.6.2. Certificate Chains
CA hierarchies are reflected in certificate chains. A
certificate chain
is series of certificates issued by
successive CAs.
Figure B.7, “Example of a Certificate Chain”
shows a certificate chain leading from
a certificate that identifies an entity through two subordinate CA certificates to the CA certificate for
the root CA, based on the CA hierarchy shown in
Figure B.6, “Example of a Hierarchy of Certificate
Authorities”
.