Deploying a Root CA and a Sub CA provides both security and convenience benefits over just using a Root CA.
Root CA only (One-Tier Hierarchy):
This option is not recommended for production
A one-tier hierarchy simply involves a single entity called the Certificate Authority (CA). This CA wears two hats. The single CA is both a root CA and the issuing CA. Its public key becomes the starting point of trust – so, if you trust this root CA, you'd trust any certificates that it and its hierarchy issues. A compromise of this single CA would mean a compromise of the whole PKI!
Having a Root CA and a Sub CA (Two-Tier Hierarchy):
Over the years in my career, I've observed that this solution is the one most commonly implemented by companies. It provides a middle ground between the One-Tier and Three-Tier Hierarchies. With this setup, you keep the Root CA offline and let the Sub CA handle the issuing of certificates. This strategy reduces the exposure of your Root CA to potential attacks. This hierarchy also increases scalability beyond what's offered by the One-Tier Hierarchy since you can create multiple subs for different departments, sister companies, etc.
Considering all this, my recommendation aligns with your final suggestion: keep the Root CA as Standard and keep it off, while designating the Sub CA as an Enterprise type.
Microsoft has a very in-depth writing about this called: Securing PKI: Planning a CA Hierarchy
This writing also explains the Three-Tier Hierarchy.
Answers to good questions:
Is it possible to make an Enterprise CA subordianda of a "standard" CA?
Yes, it is possible to make the Enterprise CA a sub of your Root CA, this is an actually a very common practice.
If I keep the "standard" Root CA turned off, when should I turn it on, only when renewing the certificate of the SubCA or every time I have to issue a certificate?
The sub CA can issue certificates without needing the Root CA to be online. The Root CA only needs to be brought back online to issue a new certificate/renew the sub CA. Once the new certificate is issued/renewed, the Root CA can be taken offline again.
Similarly, if you need to revoke the sub CA (for example, if it has been compromised), you also must bring the Root CA back online. This is because the Root CA maintains the CRL (Certificate Revocation List) of all sub CAs that it has signed. However, keep in mind that revoking the sub CA will also make all certificates invalid that were issued by the sub CA.
A very sharp addition of @Massimo:
Please also note that you must still make available (and periodically update) the Certificate Revocation List (CRL) for the root CA; most certificate checks will fail if the CRL is not available for the root CA, or if it's available but it's too old. If you want to use an offline root CA, this is something you need to plan for.
