When you decide to implement ADC yes in your organization one of the first decisions you must take is
how to design your AC hierarchy see a hierarchy determines the core design of your internal PGI and
determines the purpose of which S.A. in the hierarchy.
Is C hierarchy usually includes two or more C is usually the second C and to all others.
After that deploy with a specific purpose only the route C is mandatory.
Having a Multi Level C a hierarchy that is deployed to use PGI and certificates is not mandatory for
a smaller and simpler environments.
You can have a c a hierarchy with just one deployed C.
This usually deploys as an enterprise rootsy.
Additionally you may choose to not deploy an internal CIA at all and to use externally provided certificates
if you decide to implement SCA hierarchy and have deployed a route C already you must decide which roles
to assign Cs on the second and third tires.
In general it is not recommended build an SCA hierarchy deeper than three levels unless it is in a complex
and distributed environment most commonly C hierarchies have two levels with their roots CAA at the
top level and the subordinate issue and C on the second level usually the route C is taken off line
while the subordinate C issues and manages certificates for all clients.
However in some more complex scenarios you can also deploy other types of C hierarchies in general C
hierarchies fall into one of following categories.
See hierarchies with a policy see this category is for policies which are types of subordinate seats
that are directly below the roots see in it's a hierarchy.
You use policies these two issues see certificates to subordinate seats that are directly below the
policy in the hierarchy the role of a policy is to describe the policies and procedures that an organization
implements to secure its PGI.
Are processes that really do the identity of certificate holders and the processes that enforce the
procedures that manage certificates.
Policies see issues certificates only to others is this is that to receive this certificate must uphold
and enforce the policies that the policies a defined use policies is and is not mandatory unless different
division sectors or locations of your organization require different issuance policies and procedures
however.
If your organization requires different issuance policies and procedures you must add policies to the
hierarchy to define each unique policy.
For example an organization can implement one policy for all certificates that issues internally to
employees and another policy for all certificates that it issues to users who acquire not employees.
Another category is S.A. hierarchies with cross certification trust.
In this scenario two independent C hierarchies inter operate when SCA in one hierarchy issues a cross
certified C certificate to SCA in another hierarchy.
When you do this you establish mutual trust between different C hierarchies and other category is CS
with a two tier hierarchy.
In a two tier hierarchy there is a route C and at least one subordinate C in this scenario.
The subordinate say is the responsible for policies and for issuance certificates to requesters.