PKI TechNote Topology

From Dogtag
Jump to: navigation, search

Deployment Scenarios

Dogtag Certificate System consists of multiple subsystems and they can be connected in different fashion. We will discuss some scenarios here.

Note that all connection between subsystems are SSL-protected.

RA

This is a very simple setup. The registration authority (RA) is running outside of the firewall. It will be the main interface to interact with the users.

Topology-ra.png

Key Archival

A DRM subsystem can be setup behind a CA. When the CA receives a CRMF request with the archival option, it will forward the request to DRM for key archival.

Topology-kra.png

Cloned Subsystem

To avoid single point of failure, you can clone a subsystem. A cloned subsystem requires a new LDAP instance which will have multi-master replication setup with the master LDAP instance. The subsystem itself supports multiple failover connections.

Clone.png

Token Management

In this token management setup, TPS is running outside of the firewall, and it interfaces with ESC directly.

Topology.png