Security Domain Roles - Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual

Chapter 4. Certificate Manager
<CAList>
<CA>
</CA>
<SubsystemCount>1</SubsystemCount>
</CAList>
</DomainInfo>
The URL to the CA uniquely identifies the security domain. The security domain is also given a friendly
name, such as Example Corp Intranet PKI. All other subsystems -- DRM, TPS, TKS, OCSP,
and other CAs -- must become members of the security domain by supplying the security domain URL
when configuring the subsystem.
The registration involves adding the following information to the security domain's subsystem registry
file, domain.xml:
• A user-friendly name such as Employee Certificate Authority
• A service URL
• The type of subsystem, either CA, OCSP, DRM, TKS, or TPS
Each subsystem within the security domain shares the same trust policies and trusted roots which can
be retrieved from different servers and browsers.
The information available in the security domain is used during configuration of a new subsystem,
which makes the configuration process streamlined and automated. For example, when a TPS needs
to connect to a CA, it can consult the security domain to get a list of available CAs.
A subsystem retrieves information in the security domain through XML messages over HTTPS.
The subsystem authenticates to the security domain using a subsystem certificate. To issue a
certificate automatically during configuration, a security domain administrator must authenticate to
the security domain using a UID and password. More information on security domain roles is given in
Section 4.4.2, "Security Domain

4.4.2. Security Domain Roles

The security domain allows the roles defined in
Role
Security Domain Administrators
108
<SubsystemName>rhpki-ca</SubsystemName>
<Host>server.example.com</Host>
<SecurePort>9543</SecurePort>
<DomainManager>true</DomainManager>
<Clone>false</Clone>
Roles".
Table 4.1, "Security Domain User
Description
• Add and modify users in the security domain's
user and group database.
• Manage the shared trust policies.
• Manage the access controls on the domain
services.
By default, the CA administrator of the CA
hosting the domain is assigned as the security
domain administrator.
Roles".