An enterprise security architect is establishing a two-tier internal Public Key Infrastructure (PKI) hierarchy. The Root CA will remain air-gapped to maintain security, while a new Intermediate CA will issue operational certificates to web servers. Place the administrative steps for provisioning and activating the Intermediate CA into the correct chronological order from first to last.
- 1Generate a private key and a Certificate Signing Request (CSR) on the Intermediate CA server.
- 2Transfer the CSR to the air-gapped Root CA system using approved out-of-band offline media.
- 3Sign the CSR using the Root CA private key with Certificate Authority path constraint extensions.
- 4Import the signed Intermediate certificate onto the Intermediate CA server and distribute the Root CA public certificate to the enterprise trust store.
Answer
The correct administrative order is to first generate the private key and CSR locally on the Intermediate CA, transport the CSR out-of-band to the air-gapped Root CA, sign the request with the Root CA's private key, and finally import the signed intermediate certificate into the Intermediate CA while publishing the Root CA public certificate to the enterprise trust store.
In a standard two-tier PKI hierarchy with an air-gapped Root CA, the Intermediate CA first generates its own private key and CSR locally. The request is transported out-of-band to the Root CA, which signs the request using its private key. Finally, the signed certificate is installed on the Intermediate CA, and the Root CA's public certificate is deployed to endpoints' trusted root store to establish a valid trust chain.
Step-by-Step Solution
Key Concept
Two-tier PKI deployment and Intermediate CA certificate signing workflow