Red Hat CERTIFICATE SYSTEM 8 Install Manual page 40

Chapter 3. Installation and Configuration
• Subordinate CA. A subordinate CA receives its CA signing certificate from a root CA. The root
CA must be referenced here; it can be another Certificate System CA, but, for the default (i.e.,
first) CA instance, this will probably be an external root CA. The certificate requests generated in
this process must be submitted to the external CA and be approved before configuration can be
completed.
See the planning question
1
subordinate CA?
.
6. Fill in the information for the LDAP server which will be used for the instance's internal database.
This requires connection information for the Directory Server instance, such as the hostname, port
number, bind DN (username), and password. This step also creates a database in the Directory
Server and a corresponding base directory entry (base DN) to use for the subsystem's entries.
The hostname can be the fully-qualified domain name or an IPv4 or IPv6 address, if IPv6 was
configured before the packages were installed.
NOTE
One thing that can derail subsystem configuration or function is having services that
are unable to connect with each other. If servers that need to communicate with each
other are on different servers or networks, when the firewalls and iptables must be
configured to give the required access.
30
Should the Certificate Manager be a self-signed root CA or a