CA Hierarchy
In a hierarchy, one root CA provides CA certificates for another level of CAs. While there are many hierarchical designs that can be arranged, the classic, best practice design is displayed in Figure 10-2,In this design , the root CA is kept offline and produces CA certificates only for the next, intermediary level; the issuing CAs that actually issue certificates for end use such as EFS or smart card. Issuing CAs do not issue CA certificates