Let's cover the Root CA Considerations, what you need to know.
Your first question, is this online or is this offline?
Are you going to have it run or not run, be shut off somewhere?
It is going to be online if it is an enterprise CA.
It's going to be offline mostly if it's a root CA
because you want to protect that.
The name.
Considering that you cannot change the name once you make it,
I would suggest you make it as descriptive as possible.
The validity period,
how long is this going to function before you have to renew that certificate,
and as it gives out certificates,
how long before a policy CA or an issuing has to renew
their certificate in order to function?
Cryptographic algorithms and the hash,
how complicated are you going to make this?
The more complicated, the safer, the more complicated,
the bigger load on your system.
And then character length.
You have to consider how long you're going to keep your
characters and then where are you going to store your CRL
distribution point and the AIA, which establishes authority.
You need to have a location considered before the root CA.
If it is offline,
you're going to have to move that to a subordinate CA somewhere.
That's what we're going to do.
Some practical root CA considerations.
Who designates the root CA given that the root CA is
uber‑important to the practicality and the functioning of your
certification authority infrastructure?
Who manages the root CA?
This should be the top trusted people that you have?
Perhaps it's you.
Will the root CA to respond to certificate requests? In other words,
are you going to just have an empty root as it were, take it offline,
or is it going to actually be an issuing CA as well?
And then finally, where will the root CA be stored?
Because if the root CA is offline,
it essentially becomes a file. Where are you going to store that file?
It has to be in a safe location.
So that is what you should consider before you establish your root CA.
Now, we're ready to set up our root CA and get going with our certification hierarchy.