三类证书场景下，应配置多根CA还是单根CA+多中间CA的PKI架构？

Great question—let’s break this down based on your requirements (three isolated certificate scenarios, no third-party CA, one key pair per use case) and standard PKI best practices.

Option 1: Three Independent Root CAs #

• Pros:
  • Complete isolation: A compromise or issue with one root CA won’t impact the other two scenarios. This is ideal if your use cases are entirely unconnected and require strict security boundaries.
  • Clear permission separation: Each root only handles certificate issuance for its specific use case, reducing the risk of cross-scenario misconfiguration.
• Cons:
  • Higher management overhead: You’ll need to maintain three separate root CA lifecycles—including offline storage, backups, revocation, and renewal.
  • Increased client/server configuration: Every endpoint (web servers, external clients, internal servers) will need to trust three distinct root certificates, which adds setup and maintenance work.

Option 2: One Root CA + Three Intermediate CAs #

• Pros:
  • Enhanced security with layered isolation: Keep your root CA offline (the most secure practice) and use dedicated intermediate CAs for each use case. If an intermediate CA is compromised, you only need to revoke that intermediate and issue a new one—your root CA (and all other scenarios) remain unaffected.
  • Simplified trust management: All endpoints only need to trust a single root certificate, cutting down on configuration complexity across your infrastructure.
  • Scalability: If you add new use cases later, you can spin up additional intermediate CAs without touching your root CA, which aligns with enterprise PKI design standards.
• Cons:
  • Single point of failure (the root CA): But this risk is negligible if you store the root CA securely offline (e.g., air-gapped, hardware security module) and limit access strictly to renewal of intermediate CAs.

Other Possible Options? #

You could technically use a single root CA to directly issue certificates for all three use cases, but this is not recommended. It removes any isolation between scenarios—if a certificate from one use case is misused or compromised, it puts the entire root CA’s trustworthiness at stake. It also lacks the permission boundaries that intermediate CAs provide.

Final Recommendation #

Go with one root CA + three intermediate CAs. This strikes the perfect balance between security, manageability, and scalability for your use cases. The layered structure keeps your most sensitive component (the root CA) protected, while each intermediate CA enforces clear boundaries for its specific scenario.

内容的提问来源于stack exchange，提问作者Andrew Martinez