PKI Implementation

[Ed Gallagher]

I'm implementing a two tier, offline Root CA, PKI for a small client with need for some "proper" security. Since it is a small business, I'm trying to reduce server count to keep maintenance and licensing costs down.
So I'm wondering what else would be reasonable to run on the same VM as the Enterprise CA.
Since I am also going to implement AAD Connect, are there any issues/risks associated with running AAD Connect and the Enterprise CA on the same server?
Any other thoughts or ideas?
Thanks

[#2]

IMO, I will keep Certificate servers always separately from other roles while you also have to think how to publish CRL list for example to Internet if there is a need. Secondly if something happens there is a risk how the renew all certificates in the client side where the users interuption shows a major thing if they cannot for example sign in to Network while the IEEE802.1x does not work.

Petri

[#3]

If the customer has a small team and is not very process orientated it may make sense to dis regard the "offline" RootCA. This may seem counter intuitive but it requires additional disciplined processes for management and maintenance and it's value is limited unless it is genuinely offline and is never connected to a network.