This figure shows a Certificate Authority CA hierarchy in which two geographically distinct sites are each served by a pair of Sub CAs; one Sub CA is online and functions as the issuing CA, while the other, higher Sub CA is offline for security. Both pairs of Sub CAs are, in turn, subordinate to the root CA.