| Q: | Which CA in the production hierarchy must be issued the Cross Certification Authority certificate to satisfy the design requirements? |
| A: | It must be issued to The Phone Company South CA. If you issue the Cross Certification Authority certificate to The Phone Company Policy CA, certificates could be trusted from The Phone Company Policy CA and its two subordinate CAs: The Phone Company North CA and The Phone Company South CA, subject to any defined basic constraints. |
| Q: | What CA must be used to issue the Cross Certification Authority certificate on the test network to satisfy the design requirements? |
| A: | The Cross Certification Authority certificate can be issued by either The Phone Company Test North CA or The Phone Company Test South CA. Both CAs are enterprise CAs, and there are no restrictions on which issuing CA must be used. It is easier to work with two CAs at the same location (Barcelona), so this example uses The Phone Company Test South CA. |
| Q: | If the Cross Certification Authority certificate is issued to the The Phone Company Policy CA, what lines must be included in the Policy.inf file to recognize certificates issued by the The Phone Company South CA? |
| A: | [BasicConstraintsExtension]
PathLength = 1 |
| Q: | If the Cross Certification Authority certificate is issued to the The Phone Company South CA, what lines must be included in the Policy.inf file to recognize certificates issued by the The Phone Company South CA? |
| A: | [BasicConstraintsExtension]
PathLength = 0 |
| Q: | What name constraints are required in the Policy.inf file to limit permitted certificates to the single certificate issued to the software development manager? |
| Q: | What application policy entries are required in the Policy.inf file to limit the certificates to only code-signing certificates? |
| Q: | Assuming that the Cross Certification Authority certificate is issued by the The Phone Company Test South CA to the The Phone Company South CA, how does the certificate chain for the manager’s certificate look when viewed on a computer running Windows XP in the certification forest? |
| A: | The Phone Company Test Root CA => The Phone Company Test Policy CA => The Phone Company Test South CA => The Phone Company South CA => The Phone Company |
| Q: | Assuming that the Cross Certification Authority certificate is issued by the The Phone Company Test South CA to the The Phone Company South CA, how does the certificate chain for the manager’s certificate look when viewed on a computer running Windows Vista in the production forest? |
| A: | The Phone Company Root CA => The Phone Company Policy CA =>The Phone Company |
