Creating A Security Domain - Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual

Role
Enterprise CA Administrators
Enterprise DRM Administrators
Enterprise OCSP Administrators
Enterprise TKS Administrators
Enterprise TPS Administrators
Table 4.1. Security Domain User Roles
As necessary, the security domain administrator can manage access controls on the security domain
and on the individual subsystems. For example, the security domain administrator can restrict access
so that only finance department DRM administrators can set up finance department DRMs.
Enterprise subsystem administrators are given enough privileges to perform operations on the
subsystems in the domain. For example, an enterprise CA administrator has the privileges to have
sub-CA certificates approved automatically during configuration. Alternatively, a security domain
administrator can restrict this right if necessary.

4.4.3. Creating a Security Domain

A security domain can be created during the CA configuration. During CA configuration, the wizard
asks if a security domain should be created. If Yes is chosen, then a user-friendly name must be
provided for the security domain. The name is used as the default Organization component in the
issuer DN.
Description
• Automatically approve any sub-CA, server,
and subsystem certificate from any CA in the
domain.
• Register and unregister CA subsystem
information in the security domain.
• Automatically approve any transport, storage,
server, and subsystem certificate from any CA
in the domain.
• Register and unregister DRM subsystem
information in the security domain.
• Push KRA connector information to any CA.
• Automatically approve any OCSP, server,
and subsystem certificate from any CA in the
domain.
• Register and unregister OCSP subsystem
information in the security domain.
• Push CRL publishing information to any CA.
• Automatically approve any server and
subsystem certificate from any CA in the
domain.
• Register and unregister TKS subsystem
information in the security domain.
• Automatically approve any server and
subsystem certificate from any CA in the
domain.
• Register and unregister TPS subsystem
information in the security domain.
Creating a Security Domain
109