After you design and deploy C hierarchy you must configure various options for CS you must have efficient
methods for C hierarchy management and for configuring security options or auditing and monitoring ADC
s provides several methods for C hierarchy management.
In this section you'll learn how to administer and manage C a hierarchy and c is so after completing
the section you'll be able to explain how to manage C is describe how to configure C security describe
how to configure security roles for C administration describe how to configure or C a policy and exit
modules describe how to configure C DP and a I a locations and configure C properties.
But before we start the section as usual let's answer several reassessment questions.
Question one which of the following options are true statements regarding a role based administration
of your ADC as deployment.
Option 1 ADC is automatically creates three built in roles and groups for C. administrator cert manager
and enrollee option 2.
You can grant ADC s role groups one or more of the following C permissions.
Manage C issue and manage certificates read and to request certificates.
Option 3.
You can limit the issue of and manage certificates C permission to a specific template or set of templates
option for you can create custom ADC as a rule groups based on the specific needs of your organization
and the last option is the authenticated user security principal canon rule for any certificate that
is pushed on and c no stop here and think about the correct answers and the correct answers are option
2 option 3 and option 4 rule based administration and ADC.
So that concept not a feature that is installed automatically.
Therefore you must manually create any role groups after you have created a role group you can assign
it to one or more of the following C permissions.
Manage C issue and manage certificates read request certificates.
You can customize the rules according to the needs of your organization including restriction on the
issue and manage certificates permission to a specific template or set of templates.
There are some ticketed users security principal can request and a certificate but the certificate template
controls the ability to enroll not the C itself.
Now let's answer the second question which of the following are true statements regarding the a I and
DP extensions of a C we have 5 4 options.
Option 1.
Each extension requires a minimal of 2 Well it and accessible your ls for certificate will edition to
function properly option 2 you can manually publish of line and standalone sales certificates and serials
in the HDD environment.
Option 3.
The order in which you specify a and c DP your Ls is not as important as certificate chain in engine
that automatically orders locations based on the fastest connection option for to facilitate certificate
validation for external clients.
You should publish external and CTP URLs by using H2 t bills through a window server 2016 web application
proxy.
And the last option is if you are using an enterprise C internal certificate validation will work without
any additional configuration.
Press both here and think about it and the correct answers are option 2 option 4 and option 5 for a
certificate validation to function the ANZ Id be extensions must contain a minimum of 1 Well it and
accessible your rule for a fly on and standalone CS you can manually publish the C certificate and CRL
into Edit Here's the order of a and c or else is important as a certificate change and engine will search
them sequentially.
You should place the Urals.
Most likely to be away lable at the top of the euro.
Order.
To facilitate certificate validation for external clients you can publish AAA and CTP or else by using
H2 to pass through a window server 2016 web application proxy or other third party.
Reverse props proxies solution if you are a an island and an enterprise certificate validation will
work automatically for internal clients but might require further configuration in other scenarios.
So after completing this assessment let's get started and begin to this section which is administering
CS elsewhere in the next lesson.