How to Install an Enterprise Certificate Authority

Introduction

Active Directory Certificate Services (AD CS) provides the certificate infrastructure to enable scenarios such as secure wireless networks, virtual private networks, Internet Protocol Security (IPSec), Network Access Protection (NAP), encrypting file system (EFS) and smart card logon.

This walkthrough provides step-by-step instructions on how to stand-up an Enterprise Subordinate Certificate Authority (CA).

Prerequisites

1. The user performing the installation and configuration of the Active Directory Certificate Services Role must be a member of the Enterprise Admins group.

Notes

1. CA = Certificate Authority
2. All CA roles mentioned in this post are integrated with Active Directory, as such, are known as Enterprise CAs.
3. A Root CA already exists in my lab environment.
4. During this walkthrough, you will install and configure a new Subordinate CA.

Overview

1. Install Active Directory Certificate Services.
2. Configure Active Directory Certificate Services.
3. Obtain a signed certificate from the Root CA.
4. Install the Subordinate CA certificate

Install Active Directory Certificate Services

1. RDP to the server designated as the new Subordinate CA.
2. Server Manager
3. Add Roles and Feature

1. Click Next

1. Accept the default Role-based or feature-based installation option
2. Click Next

1. Select a server from the server pool
2. Click Next

1. Check Active Directory Certificate Services
2. Click Next

1. Ensure the Include management tools (if applicable) option is checked
2. Click Add Features

1. Click Next

1. No additional Features required
2. Click Next

1. Click Next

1. Optionally check Certification Authority Web Enrollment

Certificate Authority Web Enrollment provides a simple Web interface that allows users to perform tasks such as request and renew certificates, retrieve certificate revocation lists (CRLs), and enroll for smart card certificates.

1. Ensure the Include management tools (if applicable) option is checked
2. Click Add Features

1. Ensure both Certificate Authority and Certification Authority Web Enrollment are checked
2. Click Next

1. Review the Web Server Role (IIS) – Things to note.
2. Click Next

1. Click Next

1. Click Install

1. Click Close

• This concludes the installation of the Active Directory Certificate Services role.

Configure Active Directory Certificate Services

1. While on the server designated as the new Subordinate CA.
2. Server Manager
3. Post-deployment Configuration
4. Configure Active Directory Certificate Services…

1. Ensure the account is a member of the Enterprise Admins group.
2. Click Next

1. Check Certification Authority
2. Check Certification Authority Web Enrollment
3. Click Next

1. Select Subordinate CA
2. Click Next

1. Select Create a new private key
2. Click Next

1. Select the appropriate cryptographic options for your environment.
2. I used the defaults.
3. Click Next

1. If necessary, modify the Subordinate CA certificate attributes.
2. Click Next

1. Select Save a certificate request to file on the target machine
2. Later you will copy the certificate request file (.req) to the Root CA.
3. Click Next

1. If necessary, change the CA Database locations, i.e. have the database and/or log files written to different disks.
2. As this is a lab environment, I used the defaults.
3. Click Next

1. Review and click Configure.

1. Review the next steps
2. Click Close

• This concludes the configuration of the Active Directory Certificate Services role.

Obtain a Signed Certificate From the Root CA

1. Copy the Subordinate CA .req file to the Root CA.
2. RDP to the Root CA
3. Server Manager
4. Certification Authority
5. Submit new request…

1. Save the generated Subordinate CA .cer file locally.

Install the Subordinate CA Certificate

1. Copy the .cer file to the Subordinate CA server
2. RDP to the Subordinate CA server
3. Server Manager
4. Find and select Certification Authority

1. All Tasks
2. Install CA Certificate…

1. Find and select the .cer file
2. Click Open

1. All Tasks
2. Start Service

1. Verify the CA service has started.

Conclusion

This concludes the installation and configuration of the Enterprise Certificate Authority (CA).