See below for the components in an Active-Warm Standby architecture for disaster recovery.
Load balancer
Redirects end-entity and operator requests to the active data center. The client-facing hostname or IP address of both data centers must be the same and always match:
- The hostname of the Management Console URL
- The IP address or hostname in the CDP (CRL Distribution Points) and AIA (Authority Information Access) fields of the certificates issued by the Certificate Authority.
- The CA Gateway IP address or hostname configured in client applications such as Certificate Manager or Certificate Enrollment Gateway.
The customer must provide and configure this load balancer to meet the requirements of the disaster recovery architecture, in accordance with the vendor's instructions.
CSP PKI Hub clusters
In the Active-Warm Standby architecture:
- PKI Hub cluster 1 is the active cluster in the active data center, hosting a multi-node installation of the Cryptographic Security Platform PKI Hub.
- PKI Hub cluster 2 is the passive cluster in the passive data center and hosts a multi-node installation of the Cryptographic Security Platform PKI Hub that replicates PKI Hub cluster 1.
CSP PKI Hub solutions
The Active-Warm Standby architecture supports all CSP PKI Hub solutions.
Database cluster
This cluster hosts a PostgreSQL database across 4 nodes in 2 data centers (2 database nodes per data center).
- The primary (read-write) node must be in the active data center.
- In both data centers, the database must be accessible at the same URL.
The customer must provide and configure this PostgreSQL database cluster to meet the requirements of the disaster recovery architecture, following the vendor's instructions.
Hardware Security Module cluster
Both data centers share the same Hardware Security Module (HSM) cluster.