ccna best practice

ccna best practice.Difficult to scale to large environments. The need for strict centralized administration.214 Chapter 7 Cryptosystems.It creates a single point of failure. The use of a single signed private key has a critical weakness: if the key is stolen. the entire PKI disintegrates.because the CA can no longer be trusted to be the sole signer. Because of its simplicity, VPNs managed by a single organization often use this topology.7.4.6.2 Layered CA TopologyFurther than a single root CA, a more complex topology would involve multiple CAs within the same organization o In a layered CA topology, the CAnJ' to issue certificates to end-users and affiliated CAs, and the affiliated CAs to mow to issue their certificates to end-users and/or other CAs. This approach establishes a . tree of CAs and end-users, where each CA in the JI: can issue certificates to CAs and end-users at lower tiers.The jade key advantage of a hierarchical PKI topology is the enhanced scalability brush manageability. Trust decisions can now be distributed to smaller branches on a hierarchical basis. This distribution works well in large armatures with large numbers of services. For example, a large public company can have a root CA that issues certificates to secondary CAs, and these secondary CAs issue certificates to end-users. Since the root signing key is rarely used after a slave CA certificate is issued, the root signing key is rarely exposed and trustworthiness is greatly improved. In addition, if the private key of a slave CA is stolen, only . The branch of a PKI is no longer trusted.One problem with the hierarchical PKI topology is finding the certificate path for the certificate. Determining the chain of signature processes can be difficult when the root CA and the end-user are added to the chain.This task becomes more difficult when more CAs are added between the root CA and the end user. Another implementation of a hierarchical PKI is known as cross-certified CA or cross-recognition.establish a horizontal trust relationship by cross-validating their own CA certificates.