Phase 3: Root CA Trust Setup
EC establishes the offline Root CA as the trust anchor for the new PKIaaS hierarchy. Its certificate is distributed to the customer so relying parties can trust certificates issued by subordinate CAs under that Root. The Root CA is used only for controlled CA-level operations and Root CRL publication.
Key activities
- Build and harden the standalone Root CA according to the approved design. Bind it to the Root CA key generated through the HSM and issue its self-signed CA certificate.
- Inspect the Root CA certificate to verify its subject name, validity, algorithm, key usage, Basic Constraints, and other approved extensions. Record its fingerprint for secure verification during customer distribution.
- Configure the Root CA CRL schedule and publication process. Generate the initial Root CRL, publish it to the agreed repository, and verify that customer systems can reach the exact CDP URL.
- Provide the Root CA certificate to the customer through the approved transfer method. The customer distributes it to the relevant trusted root stores through Group Policy, MDM, configuration management, or application-specific procedures.
- Test Root CA trust on representative customer endpoints and applications. Configure monitoring and operational alerts so EC has sufficient time to publish a replacement Root CRL before the current one expires.
- Complete the Root CA backup and return it to its defined offline state after the required signing and publication activities.
Phase outcome
At the end of this phase, the new Root CA exists and the customer's systems trust it. The Root CA certificate has been checked against the approved design and its fingerprint recorded. It has been delivered to the customer and placed in the relevant trusted root stores through Group Policy, MDM or another agreed method. The first Root CRL is published at the agreed address and can be reached from the customer network. Trust has been tested on representative endpoints and applications, monitoring is in place to warn before the Root CRL expires, and the Root CA has been backed up and returned to its offline state. Certificates issued later by the Issuing CAs are therefore trusted automatically by these systems.
The detailed build procedure is in Build the Root CA.