Keep the root boring
An offline root exists to make compromise difficult and recovery predictable. Its procedures should favour few dependencies, explicit quorum and rehearsed activation over convenience.
Design the operational tier for change
Issuing CAs carry the daily workload. Separate policy where risk or ownership differs, keep publication endpoints independent of a single server and define how templates move from request to review to production.
- Offline root with scripted activation
- At least one resilient issuing path
- Stable AIA and CDP locations
- Documented backup, restore and key-compromise procedures
This field note is general technical guidance. The safe remediation sequence depends on the hierarchy, clients and controls in the actual estate.