Adding a new CA domain

When you want to operate more than one certificate authority (CA) on a single z/OS® image, you must create a separate CA domain for each CA. Each CA domain uses its own daemon and operates as its own instance of PKI Services. This topic describes how to add a new CA domain. (If you want to add a new application domain, see Adding an application domain.)

When you add CA domains, you can create a PKI infrastructure that contains subsets of end user populations (application domains), each supported by its own unique PKI Services application (PKI Services daemon and URL) and optionally by its own dedicated set of PKI administrators. If you already use multiple application domains, the key advantage of adding multiple CA domains is that you can build a certificate hierarchy of CAs and optionally provide certificate services to multiple organizations.

When you add a new CA domain, your users still have a unique URL and set of certificate templates to choose from, but they also have the services of their own CA including the CA's certificate, signing key, object store, and issued certificate list (ICL), and LDAP repository. Enabling multiple CAs is a natural extension for multiple application domains. Each CA domain can represent one instance of a CA, backed by a unique instance of the PKI Services daemon (and all its associated components), yet requiring no more than a single HTTP Server and a single set of CGIs.

Figure 1 contains an illustration showing two CA domains, one for employees and one for customers. In the illustration, a single shared administrator supports both CA domains. (You can decide to share a common administrator across multiple CA domains or have separate administrators who are each dedicated to only one CA domain.)

Figure 1. Illustration of two CA domains, one for employees and one for customers, administered by a single shared administrator who administers both domains. This illustration assumes that you are implementing the web application using REXX CGI execs. If you are using JSPs, the name of the template and the tags used differ from those shown.