In cryptography a certificate authority or certification authority (CA) is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. A CA acts as a trusted third party—trusted both by the subject (owner) of the certificate and by the party relying upon the certificate.
An important part of PKI planing is planning how many tiers the CA Hierarchy will have. There are three options: Single/One-Tier Hierarchy, Two-Tier Hierarchy, and Three-Tier Hierarchy.
This Hierarchy consists of one CA. The Single CA is both the root CA and the issuing CA. A root CA is the trust anchor of the PKI. A root CA public key serves as the root of trust for a certificate. Any applications, users, or computers that trust the root CA also trust any certificates issued by the CA.
This one-tier hierarchy is not recommended for any production scenario because with this hierarchy, a compromise of the single CA equates to a compromise of the entire PKI. For security reasons, root and issuing CAs are normally separated since it is generally very difficult to quickly distribute a new root CA certificate to replace a compromised CA.
A two-tier hierarchy is the design that meets most company’s needs. In some ways it is a compromise between the one and three-tier hierarchies. In this design there is a root CA that is offline and a subordinate issuing CA that is online. The level of security is increased because the root CA and issuing CA roles are separated. But more importantly the root CA is offline protecting the private key of the root CA from a compromise. The two-tier hierarchy also increases scalability and flexibility due to the fact that there can be multiple issuing CAs subordinate to the root CA. This allows administrators to deploy CAs in different geographical locations, as well as with different security levels. However the extra security comes with higher costs. Manageability is increased since the root CA has to be manually brought online to sign CRLs. Capital cost is also increased since an additional server or a virtual machine and Hardware Security Modules (HSM) are needed. The two-tier hierarchy is the recommended design for most PKI solutions.
Difference Between Root and Issuing CAs
A three tier hierarchy adds an extra Intermediate CA between the Root CA and the Issuing CAs. This intermediate CA is usually used to enforce issuing policies to impose issuing boundaries for the issuing CAs. Unless the organization is running a very large PKI infrastructure that require multiple teams across the organization, this approach is not recommended since it adds extra complexity.