In this video from ITFreeTraining I will look at designing a Certificate Hierarchy. If you
start using certificates in your organization, you will need to understand how a certificate
hierarchy works in order to implement an effective hierarchy for your organization. This video
will look at 3 different hierarchies that are available so you can choose the hierarchy
that will meet your needs. When considering which hierarchy to use, you
should consider the size of your company. The more certificates that are required, the
more load it will put on the Certificate Authorities. The next point to consider is the geographic
distribution of the company. If there are a lot of wide area networks used on the network,
these can become congested or unavailable causing problems if the client requires them
to contact a Certificate Authority. When deploying your certificate authorities you want to take
this into account. This may seem like not much of a concern for issuing certificates,
but remember that a certificate must be verified that it has not been revoked before it can
be used. This means that when the certificate is used, a Certificate Authority or an online
responder needs to be contactable to verify the certificate is valid. Once you have taken
all this into account, you can start looking at which certificate hierarchy that you want
to use. A single Tier Hierarchy is simply a network
that has one Certificate Authority. It is mostly used in small organizations with only
up to a few hundred employees. Since it is the only CA on the network, it needs to be
always online. This does cause security concerns as the private keys used to generate the certificates
are stored on the server. If the server was to be compromised, an attacker may be able
to gain access to these keys. Since there is only the one server there is
less administration required, however this also means no redundancy. If the server was
to fail, no certificates could be issued. If you plan on using a single Tier Hierarchy
you should keep this in mind. The next form of CA that you may use is a
Two-Tier Hierarchy.. To improve security, once the second level CA's have their certificates,
the root CA is usually taken offline until it is needed again.
Two-Tier offers redundancy and can also offer additional functionality. In this example,
a CA could be used on the internal network for clients and another CA used for external
clients. You are free to add as many CA on the 2nd level as required.
The next hierarchy is three-Tier. This gives the company more security for the CA infrastructure
and flexibility. Generally the first two levels of CA's will be made offline when not required.
Once they have issued their certificates to their subordinate CA's they are no longer
required to be online. The only time they need to be online is when a new CA is required
to be added or a certificate issued to these CA's.
Once you determine what hierarchy you want to deploy in your organization, the next point
that you need to consider is how long the certificates that these CA's issued should
be valid for. A rule of thumb is that a parent CA expiry time should be twice that of the
subordinate CA. If you were to use the same value, for example
1 year, this means that on the second day a CA would be issuing certificates to clients
that would expire after the CA. Although the standard defining CA's allow this to occur,
if you use a Microsoft CA, the Microsoft CA will not allow the certificate to be issued.
If you have 2 levels of CA's, a normal practice would be to have the root CA configured to
20 years. The 2nd level to 10 years and the certificates issued configured to 5 years.
Given the time it take to decrypt data encrypted with a certificate and how much faster computing
power becomes each year, 20 years is a good time period to use. For a root CA, it is unlikely
that you would use a value that is greater than 20 years.
Thanks for watching this video from ITFreeTraining. For more free videos please feel free to subscribe
or visit our website. See you in the next video.