85 lines
2.3 KiB
Markdown
85 lines
2.3 KiB
Markdown
\> [!caution] This page contained a drawing which was not converted.
|
||
|
||
CA will be Windows 2019
|
||
Servers, hosted on
|
||
existing virtual infrastructure
|
||
|
||
Version:
|
||
ESXi 6.7U3
|
||
|
||
All VMs are on Dell XC6320-6 hardware.
|
||
|
||
**Root CA CBP-NPE-CA1**
|
||
**TNWG01A-V1650**
|
||
**Data Center: NDC**
|
||
|
||
**NPE cert Specs:**
|
||
**Key lengths: RSA 2048**
|
||
**Signatures: RSA, SHA256**
|
||
**Encryption: AES256**
|
||
**Crypto Module**
|
||
**Validation: FIPS 140-2**
|
||
|
||
**Web CRL services**
|
||
**CBP-EDME-NPE-WES /TNWG01A-V1652**
|
||
**CBP-EDME-NPE-WES2 /TNWG01A-V3454**
|
||
**ldap:///CN=CBP-EDME-NPE-CA[1-9],CN= TNWG01A-V????,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov**
|
||
|
||
CBP-EDME-NPE-CA[2-9]
|
||
Sub CA's Location NDC
|
||
|
||
**(8) subordinate Ca's**
|
||
|
||
- **Issue certs to NPEs for device network Authentication**
|
||
- **Certificate Database from Sub CA's will be backed up to server in NDC**
|
||
- **CA will host and publish CRL's**
|
||
- **CA will provide auto-renewal and auto-enrollment where possible**
|
||
|
||
(1) Online Enterprise Root CA
|
||
|
||
- Issues Self-Signed Root Certificate - No DHS/FPKI Trust Anchor
|
||
- Issues Subordinate CA Certs for (8) Subordinate CA's
|
||
- Defines certificate issuance policy for Subordinate CA's
|
||
- Member of AD,CBP.DHS.GOV domain, limiting administrative access
|
||
**Two Tier Hierarchy:**
|
||
|
||
Root CA
|
||
|
||
Subordinate CA
|
||
|
||
Web CRL Service
|
||
|
||
 
|
||
|
||
Scenario1:
|
||
|
||
CA and CRL loses connectivity
|
||
(Power Failure, Natural Disaster
|
||
Hardware Failure
|
||
|
||
Scenario2:
|
||
|
||
Corruption of CA database
|
||
|
||
Scenario3:
|
||
|
||
O/S Software Update or
|
||
Other OS level fault
|
||
|
||
- Site could be down for up to CRL validity period without negative
|
||
|
||
effect on network authentication
|
||
|
||
- Request for new certs will be answered by CA. This is a feature of auto-enrollment
|
||
|
||
- Evert sub CA database is backed up to a server at NDC
|
||
- New VN can be created and CA database restored
|
||
- If unavailable CRL request will be handled by LDAP or 2 Web CRL servers
|
||
|
||
- VM snap shot will be taken prior to installing updates. If any issues are
|
||
|
||
Detected the server can be restored to its original state
|
||
|
||
- If corruption of CA server occurs, the server can be rebuilt and the
|
||
|
||
CA can be restore from backups |