Building a subordinate Certification Authority server

Subordinate CAs aren't built for redundancy, just like many other kinds of servers. They are meant for performing specific tasks that you may want to process on a subordinate CA rather than a root CA. If you issue a lot of certificates or different kinds of certificates, you may want to differentiate between CA servers when issuing. Perhaps you want machine certificates that are used for IPsec to be issued from IPSEC-CA, but the SSL website certificates that you issue should show as being issued from WEB-CA. Rather than building out two independent root CAs that both have top-level rights, you should consider creating a single root CA, maybe called ROOT-CA, and placing these two CA servers in a subordinate role under the root CA in the chain. This can also be useful for geographically dispersed networks that have subordinate CA servers dedicated to assigning certificates for different offices or regions.

As we discussed...