When you decide to implement ADC s in your organization one of the first decisions you must take is
how to design your SCA hierarchy see a hierarchy determines the core design of your internal PGI and
determines the purpose of which CAA in the hierarchy.
Each C hierarchy usually includes two or more C is usually the second C and all others after that deploy
with a specific purpose only the route C is mandatory.
Having a Multi Level C a hierarchy that is deployed to use PGI and certificates is not mandatory for
a smaller round simpler environments.
You can have a c a hierarchy with just one deployed C this usually deploys as an enterprise rootsy.
Additionally you may choose to not deploy an internal CIA at all and to use externally provided certificates
if you decide to implement SCA hierarchy and have deployed a root CEO already you must decide which
roles to assign Cs on the second and third tires.
In general it is not recommended build an SCA hierarchy deeper than three levels unless it is in a complex
and distributed environment most commonly C hierarchies have two levels with their roots S.A. at the
top level and the subordinate issue and C on the second level usually the route C is taken off line
while the subordinate C issues and manages certificates for all clients.
However in some more complex scenarios you can also deploy other types of C hierarchies in general C
hierarchies fall into one of following categories see hierarchies with policies here.
This category is for policies which are types of subordinate seats that are directly below the rules
C in it's a hierarchy you use policies.
These two issues see certificates to subordinate seats that are directly below the policy in the hierarchy
the role of a policy C is to describe the policies and procedures that an organization implements to
secure its PGI.
Are processes that will entail the identity of certificate holders and the processes that enforce the
procedures that manage certificates at policies C issues certificates only to others.
Is this is that receive this certificate must uphold and enforce the policies that the policy is a defined
use policy sees and is not mandatory unless different divisions sectors or locations of your organization
require different issuance policies and procedures however if your organization requires different issuance
policies and procedures you must add policies to the hierarchy to define each unique policy.
For example an organization can implement one policy for all certificates that issues internally to
employees and another policy for all certificates that it issues to users who are not employees.
Another category is C hierarchies with cross certification trust and this scenario two independent C
hierarchies interoperate.
When SCA in one hierarchy issues a cross certified C certificate to SCA in another hierarchy.
When you do this you establish mutual trust between different C hierarchies and other category is CS
with a two tyre hierarchy in a two tier hierarchy.
There is a route C and at least one subordinate C and this Siniora the subordinate say is responsible
for policies and for issuance certificates to requesters.