Red Hat CERTIFICATE SYSTEM 8 Install Manual page 39

Configuring a CA
5. Set up the PKI hierarchy. Commonly, the first CA is a root, or self-signed, CA, meaning that it signs
its own CA signing certificate rather than submitting its certificates to a third-party CA for issuance.
Subsequent CAs can be subordinate CAs to that root. There are many other options, depending
on the PKI environment.
For a CA, there are two possible configuration options:
• Root CA. A root CA signs its own CA signing certificate and, therefore, can set its own certificate
issuance rules.
29