Three tier PKI - support both SHA-1 and SHA-2

Hey guys,
We're about to implement a new three tier PKI - root, intermediate and Issuing CA's... is it possible to have the root and intermediate configured as SHA-1, and have multiple Issuing CA's - some SHA-1 and some SHA-2, or do the SHA-2 Issuing CA's need to
be signed by SHA-2 certificate chain?
Thanks in advance

I agree with Vadims - if you can start from scratch now I would recommend setting up different hierarchies with consistent algorithms.
The mixed scenario you propose would be sort of trade-off for existing PKIs - I had related discussions with some clients of mine:
If you have to meet SHA-2 as per compliance / security guidelines but your Root CA processes are complicated, expensive, you use HSMs at the Root level (but there is no budget / time to install another one) etc., then adding a SHA-2-capable issuing CA to
an existing hierarchy is a first step and might meet your different requirements.
Then you can start moving over all existing templates (and related apps.) to the new CA. If you are 100% sure that all your apps would support SHA-2 you could probably "upgrade" the Root CA by renewing it with a modified hash algorithm.
But you never know if you will have to support another PKI-enabled application or device in the future (some embedded system for example) that does not understand SHA-2 so you might want to keep the alternative SHA-1 hierarchy.

Similar Messages

  • I am using several Macs running Yosemite. I was recently "upgraded" to Xfinity's new cable modem which can support both 2.5Ghz and 5Ghz networks at the same time. Actually I can connect to the internet over both with a satisfactory bump in speed for

    I am using several Macs running Yosemite. I was recently “upgraded” to Xfinity’s new cable modem which can support both 2.5Ghz and 5Ghz networks at the same time. Actually I can connect to the internet over both with a satisfactory bump in speed for the Ghz. However when I connect to the 5Ghz the Time capsule disappears from the Airport Utility and claims to be Not Found. Is there something I have done wrong or just a Yosemite Teething Problem

    First restart your mac and try again.
    It could be
    that the router and the TC are interfering wirelessly with each other.
    You can check this by pressing the option key while clicking on the wireless icon on your screen
    Open Wireless Diagnostics
    enter your user password
    Press CMD 4 then Scan
    You will see all the wireless channels being used in your location and you can check if they are on the same channel
    Make the SSID for the TC simple like MyTC
    Set 5Ghz to auto
    Update the TC
    Try again
    Ted

  • Can a single Access Point support both bridge mode and Access Point mode at the same time

    Hi Guys
    Does anyone know which access point can work in both bridge mode and AP mode ?
    Cheers

    Well what are you trying to cover. If its really a large outdoor area, then look at the mesh AP. Those require a WLC. Autonomous or stand alone ap can perform bridging on one radio and client access on another. You can also look at AP that support indoor mesh that also controlled by a wlc. If your putting APs outdoors, then look at the outdoor mesh.
    Thanks,
    Scott Fella
    Sent from my iPhone

  • Need all drivers supporting both 32 bit and 64 bit

    hai this is chaitanya.. unfortunately i formatted my laptop. so i need drivers supporting both 32bit and 64 bit for windows 7 

    Are the drivers for the same model that Paul gave drivers for in Nov?
    http://h30434.www3.hp.com/t5/Wireless-Internet-Home-Networking/need-graphic-Card-driver-and-WLAN-dri...
    ******Clicking the Thumbs-Up button is a way to say -Thanks!.******
    **Click Accept as Solution on a Reply that solves your issue to help others**

  • Does NI PXI-6259 support both Traditional DAQ and NI-DAQmx of Labview 7.0 Express?

    I need to buy a Multifunction DAQ board which will be supported by both the Traditional and NI-DAQmx of Labview 7.0. Is the NI PXI-6259 appropriate for such application?
    Thank you.
    Ujwal

    M-series boards are not supported by Traditional NI-DAQ. Stick with the E-series if you require Traditional support.
    John Weeks
    WaveMetrics, Inc.
    Phone (503) 620-3001
    Fax (503) 620-6754
    www.wavemetrics.com

  • Trying to create an abstract service that supports both DataService(LCDS) and RemoteObject

    I am trying to create a generic service processor in ActionScript that would be able to use a DataService(from LCDS) or a RemoteObject, depending on a property setting. The intent is to be able to change a setting during installation to control whether DataServices would be used, or RemoteObjects. I understand that the server side logic would need to be written differently for each of the implementations.
    The challenge is that accessing a DataService is synchronous, but a RemoteObject access is asynchronous.
    For the synchronous access, I can just call a service and return the result directly to an object which can be passed back to the client.
    For the asynchronous support, extra code must be written on the client side to listen for the return of a requested result (for example, the results of a database quesy). This code must be placed outside of the service itself, thus making the generic service non-generic.
    Are there any examples available that accomplish what I am trying to do?

    Hi. As far as I know both DataService and RemoteObject are asynchronous APIs. If you call a DataService method such as fill() or call a method on your RemoteObject, code in your Flex application will continue to execute and the result from the RemoteObject or DataService request will be received asynchrounously. I don't believe there is any way currently to make synchronous or blocking calls in Flex because of the Flash Player's execution model.
    How are you planning on using the DataService and RemoteObject in your application? Is it to do something like populate a DataGrid? Do you plan on updating the data retrieved from the DataService or RemoteObject such as adding, updating or deleting records?
    The DataService API is much more powerful than the RemoteObject API, in that if you bind an ArrayCollection that is populated from a DataService to your DataGrid, when you update data in the DataGrid, the data on the server is updated and all other clients that have the same view of the data will also get the updates. You don't currently get this functionality with RemoteObjects.
    My point here is that if you wanted to write an abstract service that supports both DataService and RemoteObject and you need to be able to add, update or delete records you are going to need to write a lot of custom code to listen for collection change events when data on the client is modified and translate these change events into RemoteObject requests. Even if you did do that, other clients would not get these updates.
    If all you want to do is something simple like populate a DataGrid with data from the DataService or RemoteObject, then sure, writing an abstraction layer on the client that supports both of these wouldn't be hard.  
    -Alex

  • Is there a single sever supports both Jdev11 and Froms/Reports to deploy

    is there a single server to support both jdeveloper 11 and forms/reports to deploy on web.
    We currently have ias 10.1.2, deployed 10g forms/reports on web. we are developing new module in jdeveloper11. Can some one guide us, best way to integrate both? (we also have to implement ldap/sso soon for secuirty reasons)
    Thanks
    Lalitha

    Thanks for the reply.
    We have currently IAS 10.1.2 with forms/reports on sun machine.
    We also have brand new sum machine for other reasons. Now if we choose to use this new machine to deploy only new module which we developed in Jdev11, what would be the best steps we can take and eventually migrate/transfer old forms/reports modules to new machine.. can you please give your advice?
    Thanks
    Lalitha

  • TableCellEditor that Supports Both Date and Calendar

    Hi,
    I'm trying to write a TableCellEditor that supports both the Date and Calendar Classes (i.e., my table could have either Dates or Calendar objects, and I want this cell editor to work seamlessly with either one).
    Here is a simplified version of my code:
    public class DateCellEditor extends AbstractCellEditor implements TableCellEditor {
    /** The editor component. */
    private DateChooser editor;
    private Calendar cal;
    public DateCellEditor() {
    super();
    editor = new DateChooser();
    cal = Calendar.getInstance();
    public Object getCellEditorValue() {
    cal.setTime(editor.getDateValue());
    return cal;
    public Component getTableCellEditorComponent (JTable table,
                                                                                                                            Object value,
                                                                                                                            boolean isSelected,
                                                                                                                            int row,
                                                                                                                            int column) {
    if (value != null) {
    if (value instanceof Calendar)
         editor.setDateValue(((Calendar)value).getTime());
         else if (value instanceof Date)
         editor.setDateValue((Date)value);
    return editor;
    As you can see, I've already modified getTableCellEditorComponent to accepted object of class Date or Calendar. My problem arises in the getCellEditorValue method. How do I know which type of object to return? In the code sample above, I'm returning a Calendar object, but I'm not sure how to code this method to return either Calendar OR Date.
    By the way, editor.getDateValue() returns a Date object.
    I could easily write two separate TableCellEditors, but I would prefer a more elegant solution. Any ideas?
    Thanks!
    Karen Prengaman

    If you really must have both objects and don't want to convert one into another, you could add a function like
    setMode(int modetype) {}
    where modetype is either DATE or CALENDAR, and then return the set type when the user calls getValueAt

  • Sharepoint 2013 Foundation three tier farm with two Webservers in NLB

    Heloo,
    I have been strugling with a problem the last htree days.
    I have instelled and configured a sharepoint 2013 three tier farm with Sharepoint 2013 Foundation and MS SQL 2014 Express. This is a Test Farm and all the servers are Windows 2012 R2.
    I have one SQL Server, one Application Server and two Webservers. The tow web servers are configured with Multicasting NLB. The NLB name is "sharepoint.ws.domain.net". The IP of the NLB is also in our DNS Zone.I have made a Web Application with
    the name "sharepoint.ws.domain.net" on port 80 (NLB name) and a Site collection with the same name.
    Now whene I am working on the Sharepoint Site I get very offen a login Window or I get the message "An error occurred while processing the request on the server. The status code returned from the server was: 0".
    The error "An error occurred while processing the request on the server. The status code returned from the server was: 0" comes when I try to create a sub Site (most with no Permissions inheritance)... but not allways. I also get  sometimes
    the same message when I upload files (MS Office documents and PDF files).
    The login Windows comes whene I am navigating throw the Sites... but also not allways.I go to the Site with an IE11 and the Site is also in the Intranet security sites.
    Can you help me on this one...
    Kind Regards
    Ioannis Kyriakidis

    With no hostname on the Web Application, you have to create Host-named Site Collections. So that complicates things a bit.
    As far as NLB setup, you create Web Applications the same way you would otherwise. NLB is simply installed on both Web Servers and placed into the NLB VIP (virtual IP). The DNS A record points at the VIP.
    Also set up your Windows NLB using Unicast instead of Multicast. If you have certain types of switches that block unicast ARP from multiple clients, e.g. Cisco, you may have to make an exception for them (e.g. http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-microsoft-nlb.html).
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Can a MacBook (Early 2008) Support both sound and video to 1080p HDTV by Mini-DVI to HDMI cable?

    Can a MacBook (Early 2008) Support both sound and video to 1080p HDTV by Mini-DVI to HDMI cable?

    The mini dvi on the MacBook will only support video, in order to get audio you'll need to a cable from the sound out port to the sound in port on the TV.

  • When I plug my iPhone 4s into my PC, I get an error message that says iTunes needs a newer version of Apple Mobile Device Support. It wants me to uninstall both the AMDS and iTunes and then reinstall iTunes. Has anyone else run into this problem recently?

    When I plug my iPhone 4s into my PC, I get a message that says iTunes needs a newer version of Apple Mobile Device Support. It wants me to uninstall both the AMDS and iTunes and then reinstall iTunes. iTunes won't recognize my phone and so I can't synch it. Has anyone else run into this problem recently and how did you resolve it? Thanks!

    Thank you both. I suppose I should have prefaced my question with the concern that I've read a number of other posts from people who have had a similar issue and when they tried to follow the directions, they ran into a multitude of other problems. As you might imagine, I'm hoping to avoid the creation of new problems as I try to solve this one. Thanks again.

  • Mini DisplayPort to support both audio and video coming soon?

    So I notice that Apple updated the MacBook Pro Mini DisplayPort implementation to support BOTH audio AND video.
    Think this will make it’s way to the Mac mini soon, or an update still a long way off?

    Probably in the next refresh, but the mini was refreshed twice last year, so another refresh in less than a year would probably be too much for which to hope!
    There is always this US$49 wonder;
    http://www.monoprice.com/products/product.asp?cid=104&cp_id=10428&cs_id=1042802&pid=6331&seq=1&format=2
    Dah•veed

  • Page size that I have to put my site to see the same on a computer supports both laptop and a desktop computer ?

    page size that I have to put my site to see the same on a computer supports both laptop and a desktop computer ?

    The viewport on a computer is adjustable by the user. iWeb sets the viewport width to the page width that you chose in the layout menu. No matter what the end user does, the page width is static and a reasonable compromise for the width of a web page that will be viewed on these devices is 980 to 1024 px.
    Safari on iOS devices cannot set the viewport. The viewport on mobile devices is fixed and its width depends on the orientation of the device. The iPhone in portrait mode has a viewport width of 320px. This means that the 980px wide iWeb built page will be squashed down to about one third of its desired size making it unreadable and difficult to navigate.
    Setting the viewport meta tag so that width equals the device width is a futile gesture since Safari on iOS will do that anyway. Its only useful if you add some initial scaling like...
    <meta name = "viewport" content="initial-scale=0.7">
    In the case of a 980px wide website, the initial scale is about 0.3 so any value higher than this will magnify the initial view of the site.
    Here's an example of a 980px wide page that has been given and initial scale of 0.7 which allows an iPhone user to see one column of a two column layout...

  • IPAD3/IPAD2 :PDF files/ attachments  sent in an email  displayed inline ( embedded within the main email) in the message text on both my Ipad2 and Ipad three, however the same email displayed the PDF File icons/ attachment on both my Iphone and a friend's

    IPAD3/IPAD2 :PDF files/ attachments  sent in an email  displayed inline ( embedded within the main email) in the message text on both my Ipad2 and Ipad three, however the same email displayed the PDF File icons/ attachment on both my Iphone and a friend’s PC. How do i get both my IPAD devices to display the PDF icons/attachments? Bearing in mind if i open the same email over the internet the PDF Icons/attachments display OK!
    Has anyone come across this? Your advice/help would be most appreciated

    This happens to me all the time.
    If is a one page PDF it seems as though it comes over already open and inline in the body of the email. Multiple page PDF files show as the PDF icon.
    I can't find any official documentation of this - other than based on my own experience with PDF attachments in my various email accounts.
    Message was edited by: Demo

  • I am having flickering issues on both my timeline and when i render a clip when i drop and adjust a three way color corrector on a clip

    I am having flickering issues on both my timeline and when i render a clip when i drop and adjust a three way color corrector on a clip

    See if anything here helps:
    https://forums.adobe.com/search.jspa?q=premiere+pro+color+correction+flicker

Maybe you are looking for