Phase 4: Issuing CAs Provisioning
EC builds the online Issuing CA or CAs beneath the new Root CA. These CAs process approved certificate requests and publish the revocation information required to validate the certificates they issue.
Key activities
- Provision and harden each Issuing CA server in the EC-managed environment. Configure its HSM provider, administrative access, auditing, backup, and monitoring.
- Generate a certificate signing request for each Issuing CA using its HSM-protected key. Inspect the request against the approved CA name, algorithm, key size, and hierarchy design.
- Bring the offline Root CA online under the controlled signing procedure. Review and sign each Issuing CA request, then install the signed CA certificate on the corresponding Issuing CA server.
- Verify that each Issuing CA certificate chains to the new Root CA and contains the intended validity, CA extensions, and revocation references. Start the CA service only after its key binding and certificate chain are confirmed.
- Configure base CRL and, where required, Delta CRL publication. Publish the Issuing CA certificate and CRLs to the agreed repository, then test the exact URLs from the customer environment.
- Configure only the certificate templates and permissions approved during design. Issue a limited set of test certificates to verify the CA, HSM signing operation, template settings, chain building, and revocation checking.
Phase outcome
When this phase is complete, the Issuing CAs that will issue the customer's day-to-day certificates are ready for use. Each Issuing CA has a certificate signed by the new Root CA, uses its HSM-protected key and chains correctly to the Root. Its certificate and CRLs are published at addresses that customer systems can reach, and only the certificate templates approved during design are available. Test certificates have been issued and checked for the correct content, chain building and revocation status, which confirms that the CA, the HSM and the publication points work together as intended. The hierarchy can now issue certificates, and the next step is to connect the customer's enrollment channels to it.
The detailed build procedure is in Build the Issuing CA.