Here are some considerations for building your subordinate
CA. How is your organization divided?
Do you have different divisions that will require one subordinate CA for
them because of special needs, or are you going to have just generalized
subordinate CAs? How is your CA going to be used?
Is it going to be used to take care of a lot of devices or users or
network paths? Your validity period, how safe do you feel having a
long validity period or would you rather keep it more safe and then
have maybe your certificates expire within a year? How many sub CAs
are you going to need?
Where are your users located?
If they are not on the network,
then you need some web enrollment and other means to let your computers,
devices, users, and servers get their certificates.
And then finally, what policies do you have for enrolling people in certificates?
So much of any consideration you have here depends upon
what your business model is and what your workflow is and
your sensitivity to security.
Now that we've seen all this, we're ready to set up our subordinate enterprise C. A.