PKI deployment models
At several points in this chapter, I have mentioned the PKI hierarchy and components such as root CAs, intermediate CAs, and issuing CAs. Based on the business and operational requirements, the PKI topology will also change. There are three deployment models that we can use to address the PKI requirements. In this section, we will look into these models and their characteristics.
The single-tier model
The single-tier model is also referred to as the one-tier model, and it is the simplest deployment model for a PKI. This is not recommended for use in any production network as it's a single point of failure for the entire PKI:
Figure 13.11: Single-tier model
In this model, a single CA will act as a root CA and issuing CA. As explained previously, the root CA is the most trusted CA in the PKI hierarchy. A compromised root CA will compromise the entire PKI. In this model, it's a single server, so any breach of the server will easily...
