Dogtag supports the following installation cases:

• subordinate CA (1 step)
• external CA (2 steps)

In the subordinate CA case, the new CA has an option whether to join the existing security domain or to create a new security domain.

In the external CA case, if the parent CA is Dogtag, the new CA should have the same option as well.

To reduce code maintenance, it might be possible to merge the code for these cases. The subordinate CA install would be an automated 1-step process, while the external CA install would be a manual 2-step process. The difference is whether to sign the CSR automatically or manually.