Setting up a CA with MgmntCA and a seperate IntCA (SubCA)

[kbensch]

Hi
I am in the process of setting up a Root CA with ManagementCA
I have also setup a second server that will host the IntermediateCAs. I am able to access the adminweb but it gives the following error:
Authorization Denied
Cause: Authentication failed for certificate: CN=SuperAdmin

I can also access the RAWeb page but this give similar errors.

I have searched for documents on how to connect the 2 but it talks of Peers and I am unable to see any peers menu items on the ManagementCA AdminWeb or RAWeb. Can someone please point me in the direction of documentation that I can use to make this happen.

At some stage I will also be seeting up a RA and VA and I reckon I will also need this documentation for that.

THank you
Kobus

[merryo11]

Yes Peers are available in Enterprise version and not part of community version.

You have to activate two nodes both with separate Mgmt CA and then use external CA signing option for intermediates to sign with your ROOT CA or may be use the API.

[primetomas]

If Root CA and Intermediate CAs are on different instances this is called that the Root CA is signing external CAs (doesn't have to be from EJBCA) and the issuing CAs are making requests to an external CA. Some documentation:
https://docs.keyfactor.com/ejbca/latest/signing-an-external-ca
https://docs.keyfactor.com/ejbca/latest/creating-an-issuing-ca-signed-by-an-external-root

If you want to have the administrators using the client certs issued from the Root CA instance, you want to install your Issuing CA EJBCA's with an external administration CA. See https://docs.keyfactor.com/ejbca/latest/install-ejbca-as-a-ca-without-a-management-ca

[kbensch]

Thank you. I managed to successfully set this up.