two CA in one domain

%3CLINGO-SUB%20id%3D%22lingo-sub-2869608%22%20slang%3D%22en-US%22%3Etwo%20CA%20in%20one%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2869608%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%2C%20We%20have%20root%20domain%20(corp.com)%20and%20child%20domain%20(abc.corp.com)%20%2Cwe%20can%20build%20two%20server%20and%20add%20role%26nbsp%3Bcertificate%20authority%20and%20configure%20to%20subca%20%2C%20server%2001%20subca%20name%20CA%20SUB%2001%20%2C%20server%2002%20sub%20CA%2002.%20in%20the%20same%20domain%20can%20we%20build%20two%20CA%20%3F%20it%20have%20effect%20domain%20as%20template%20will%20the%20same%20or%20different%20%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2869608%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
New Contributor

Hi , We have root domain (corp.com) and child domain (abc.corp.com) ,we can build two server and add role certificate authority and configure to subca , server 01 subca name CA SUB 01 , server 02 sub CA 02. in the same domain can we build two CA ? it have effect domain as template will the same or different ? 

1 Reply
Yes, you can build two (or more) certificate authorities within a domain. It's not commonly done and it's not something I'd advise under normal circumstances, but you can do it.

The certificate templates are stored in the Active Directory CN=Configuration partition, meaning that single location is used by all authorities (and their subordinates). This means that any changes to these Active Directory-stored templates is visible to all authorities.

Installing a second (or more) certificate authority will not affect the templates. The templates are only installed by default when using the "Enterprise CA" option (as distinct from the "Standalone" option) and if they already exist, are left alone.

Cheers,
Lain