When is the CA server necesaary?

[mikik]

Hi:

I have  a hub and spoke network with PKI based security.  My question is , during normal operations , after certificates after been issued and the spoke routers have SA associations set up, are  there any more  communications with the CA server? Assuming that the hub and spoke routers  are constantly communicating is there a need for the CA server? Even is the communication between  a hub router a spoke router have to be renewed, is the CA server involved? As long as the certificates don't expire, is the CA server involved?

  thanks

Mickey

[Karsten Iwen · Accepted solution]

In general, the CA is only needed when a new certificate has to be issued. The normal IPSec-tunnel-setup doesn't need the CA at all.

But: When the tunnel-setup is done, the hub (or even both hub and spoke) can be configured to compare the serial-number of the presented certificate against a list of revoked certificates (a CRL, Certificate Revocation List). Although not a best practice, this list is often served by the CA. If your PKI is configured that way, then the CA has to be online all the time. If best practice was followed while setting up the CA, the CRL is published to a different server and the CA only has to be online when new certificates are issued or a new CRL is published. Here the server hosting the CRL has to be online all the time.

Similar concept, instead of a CRL you could use the Online Certificate Status Protolol (OCSP), but here is the same, instead of running that service on the CA it's better to use a different system for that.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[mikik]

Hi:

Thanks for the answer. This is also my understanding but was not sure.

Mickey