{"id":508,"date":"2026-05-25T10:56:39","date_gmt":"2026-05-25T10:56:39","guid":{"rendered":"https:\/\/cloudvlabs.com\/?page_id=508"},"modified":"2026-08-03T03:31:46","modified_gmt":"2026-08-03T03:31:46","slug":"installing-adcs","status":"publish","type":"page","link":"https:\/\/cloudvlabs.com\/?page_id=508","title":{"rendered":"Deploying PKI with Microsoft (AD CS)"},"content":{"rendered":"\n

This guide walks you through deploying a Public Key Infrastructure (PKI) using Microsoft Active Directory Certificate Services (AD CS). It follows the industry-standard two-tier Certificate Authority (CA) hierarchy, providing a secure and scalable foundation for issuing and managing digital certificates.<\/p>\n\n\n\n

What is PKI?<\/strong><\/p>\n\n\n\n

Public Key Infrastructure (PKI)<\/strong> is a framework that uses digital certificates and cryptographic keys to establish trust between users, devices, and services. It helps verify that a website, person, device, or application is genuinely who it claims to be, enabling secure authentication, encryption, and digital signing.<\/p>\n\n\n\n

Table of Contents<\/div>
<\/span><\/span><\/span><\/span><\/div><\/div>
<\/div>
    <\/ol><\/div><\/div><\/div>\n\n\n\n

    Two Tier PKI architecture<\/strong><\/h3>\n\n\n\n

    The hierarchy consists of:<\/strong><\/p>\n\n\n\n

    A two-tier Certificate Authority (CA) hierarchy<\/strong> is Microsoft’s recommended PKI design for most organizations. It separates the root of trust from the certificate issuing process, improving both security and manageability.<\/p>\n\n\n\n

      \n
    • Online Subordinate (Issuing) Certificate Authority<\/strong> \u2013 The server responsible for issuing, renewing, and revoking certificates for users, computers, and services within the organization.<\/li>\n\n\n\n
    • Root Certificate Authority (Root CA)<\/strong> \u2013 The offline, highly secured trust anchor that signs and validates subordinate Certificate Authorities.<\/li>\n<\/ul>\n\n\n\n

      Deployment Topology<\/strong><\/h3>\n\n\n\n

      High Level Deployment Requirements<\/strong><\/p>\n\n\n\n

      Before deploying the PKI infrastructure, ensure your environment meets the necessary prerequisites. This includes having an Active Directory domain, supported Windows Server operating systems, appropriate administrative permissions, DNS name resolution, and network connectivity between servers. You should also identify the servers that will host the Root Certificate Authority (CA) and the Issuing CA, define certificate validity and security requirements, and ensure backups and recovery procedures are planned. Meeting these requirements helps provide a secure, reliable, and well-managed PKI deployment.<\/p>\n\n\n\n

      Tier 1 – Deploying Offline Root CA consist of:<\/strong><\/p>\n\n\n\n

        \n
      • Install Active Directory Certificate Services (AD CS)<\/li>\n\n\n\n
      • Configure as a Standalone Root Certification Authority<\/strong>.<\/li>\n\n\n\n
      • Generate the Root CA certificate and private key.<\/li>\n\n\n\n
      • Issue the CA certificate used by the subordinate (issuing) CA.<\/li>\n\n\n\n
      • Publish the Root CA certificate and Certificate Revocation List (CRL).<\/li>\n\n\n\n
      • Keep the Root CA offline except when, renewing the subordinate CA certificate and Publishing a new CRL<\/li>\n<\/ul>\n\n\n\n

        Tier 2 – Deploying Enterprise Issuing CA consist of<\/strong><\/p>\n\n\n\n

          \n
        • Install Active Directory Certificate Services (AD CS)<\/li>\n\n\n\n
        • Configure as an Enterprise Subordinate Certification Authority<\/strong><\/li>\n\n\n\n
        • Submit its certificate request to the offline Root CA.<\/li>\n\n\n\n
        • Install the signed subordinate CA certificate from the Root CA.<\/li>\n\n\n\n
        • Configure Web Enrollment location<\/li>\n\n\n\n
        • Publish Root Public Certificate in Active Directory to Establish Trust<\/li>\n<\/ul>\n\n\n\n
          \"\"<\/figure>\n\n\n\n

          Space<\/p>\n\n\n\n

          Root Certificate Server. Installing the AD CS Role<\/strong> Part 1<\/h3>\n\n\n\n
          \"\"<\/figure>
          \n

          Server Manager > Add and Remove Roles > Select Active Directory Certificate Services<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Add all default features<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select Certificate Authority > Next > Install<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          After role as been install the server will reboot. Select Manage > Configuer ADCS<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Credentials will be the admin of the server > Next<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select Role > Certificate Authority > StandAloneCA > rootCA> Create New Key private key<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Provide a common name for the root CA> next > select validity period. > next > configure and close<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Once the role is installed. From Tools Open AD CS.<\/p>\n<\/div><\/div>\n\n\n\n

          Space<\/p>\n\n\n\n

          Deploying Enterprise Subordinate<\/strong>. Installing the AD CS Role<\/strong><\/h3>\n\n\n\n
          \"\"<\/figure>
          \n

          Server Manager > Add and Remove Roles > Select Active Directory Certificate Services<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Next > Select roles > Certifcation Authority and Certficate Authority Web Enrollment > include all default features. Note: Web Enrollment will add the Web Server IIS services which is required<\/em><\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select all default > Next and Install<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Once the all roles are installed and the server has restarted click on Post-deployment Configuration<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          As this is an enterprise subordinate CA the user which is configuring the role is required to be an enterprise admin of the domain. Note: change the user from local admin to enterprise admin.<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select both Certifcate Authority and Web enrollment roles to configuer > next<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select Enterprise CA and Select Subordinate CA > Next > Select create a new Private Key<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Select the algorithm. Note: the Algorithm used by the Subordinate CA will need to be the same as the ROOT CA. > Next <\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          The next section will create a request file. This request file will need to be copied over to the Root CA . normally saved to the C: Drive. > Select Configure<\/p>\n<\/div><\/div>\n\n\n\n

          \"\"<\/figure>
          \n

          Note: the following output says the the Subordinate CA will only be opertional once it has a vaild certifcate from the root CA. This process build the trust relationship between the Root CA and the Subordinate CA<\/p>\n<\/div><\/div>\n\n\n\n

          The pervious steps were to <\/p>\n\n\n\n

            \n
          • Install the root CA role<\/li>\n\n\n\n
          • Install the Subordinate role including Web Enrollment<\/li>\n<\/ul>\n\n\n\n

            The next section will aim to configuer the ROOT CA and the Subordinate CA<\/p>\n\n\n\n

            Root Certificate Server. Configuration Part2 <\/strong><\/h3>\n\n\n\n

            Note: The following configuration is required before issuing any certificate<\/strong><\/p>\n\n\n\n

              \n
            • CRL Location<\/strong> – or (CRL Distribution Point) is the publicly accessible web address or directory where a Certificate Authority (CA) publishes its Certificate Revocation List (CRL). A Certificate Revocation list (CRL) is a signed file maintained by a certificate authority that list certificates that have been canceled.<\/li>\n\n\n\n
            • AIA Location<\/strong> – Authority Information Access (AIA) points clients to the resources required to validate the certificate and build a complete chain of trust. Building a trust chain in a Public Key Infrastructure (PKI) is important it allows devices to verify that a security certificate is authentic and legitimate<\/li>\n\n\n\n
            • Client certificate validity period<\/strong>. Is the period that the issuing Certificate Authority (CA) certificates are validate for.<\/li>\n<\/ul>\n\n\n\n

              Configuring the CRL location<\/strong><\/p>\n\n\n\n

              \"\"<\/figure>
              \n

              Connect to the Root CA and open AD CS. Right Click on your Root Server and select properties. Under Extensions TAB > you can select CRL extensions or AIA extensions. Select CRL.<\/p>\n<\/div><\/div>\n\n\n\n

              As i will be using a HTTP location i have deleted all other location apart from the C:\\location<\/p>\n\n\n\n

              Remove the following locations<\/strong><\/p>\n\n\n\n

                \n
              • Ldap<\/strong> – location<\/li>\n\n\n\n
              • File<\/strong> – Location<\/li>\n<\/ul>\n\n\n\n
                \"\"<\/figure>
                \n

                In the following example I have selected to use a HTTP location as the CRL. I have created CNAME record in DNS which will point to the server name, in this example it is http:\/\/pki.cloudvlabs.com<\/mark>.<\/p>\n\n\n\n

                In this step I have added the http location using the example > select http location > Insert. By using the example build out the correct location string. http:\/\/pki.cloudvlabs.com\/certenroll\/<CaName><CELNameStuffix><DeltaCRLAllowed.crl<\/mark><\/p>\n<\/div><\/div>\n\n\n\n

                \"\"<\/figure>
                \n

                Enter the CRL location and select <\/p>\n\n\n\n

                  \n
                • Include in CRL . Clients use this to find Delta CRL locations<\/li>\n\n\n\n
                • Include in the CDP extension of issued certificates<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n

                  Configuring the AIA location<\/strong><\/p>\n\n\n\n

                  \"\"<\/figure>
                  \n

                  Next update the AIA location information. Select Authority Information Access (AIA)<\/p>\n\n\n\n

                  Using the example replacing server name with the http location and remove all other locations apart from the C drive location<\/p>\n<\/div><\/div>\n\n\n\n

                  CRL Publishing Parameters<\/strong><\/p>\n\n\n\n

                  \"\"<\/figure>
                  \n

                  Right click on Revoked Certificates > Properties > change the CRL publication Interval to 1 year.<\/p>\n<\/div><\/div>\n\n\n\n

                  Issuing Certificate Validity Period.<\/strong><\/p>\n\n\n\n

                  By default, a Root CA certificate in AD CS is typically configured with a validity period of around 5 years, while certificates issued by a Standalone CA default to 1 year.<\/p>\n\n\n\n

                  \"\"<\/figure>
                  \n

                  to change this setting. Open reg Editor and change the following value. Current Control Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Config\\ServerName and Edit the Validaity Period to (5)<\/p>\n<\/div><\/div>\n\n\n\n

                  \"\"<\/figure>
                  \n

                  Start and Start ADCS service<\/p>\n<\/div><\/div>\n\n\n\n

                  \"\"<\/figure>
                  \n

                  Publish new CRL. Right Click on Revoked Certifcates > Publish CRL<\/p>\n<\/div><\/div>\n\n\n\n

                  Once all configuration are completed on the ROOT certifcate server next step is to issue a certifcate to the Subordinate via the request file.<\/p>\n\n\n\n

                  Config settings completed<\/strong><\/p>\n\n\n\n

                    \n
                  • CRL Location<\/li>\n\n\n\n
                  • AIA Location<\/li>\n\n\n\n
                  • CRL Publishing internals<\/li>\n\n\n\n
                  • Validity Period<\/li>\n<\/ul>\n\n\n\n

                    Issuing a certificate via a request file<\/strong><\/h3>\n\n\n\n
                    \"\"<\/figure>
                    \n

                    Right Click on the Root CA> All tasks > Submit a new request and select the request file.<\/p>\n<\/div><\/div>\n\n\n\n

                    \"\"<\/figure>
                    \n

                    Select the request file<\/p>\n<\/div><\/div>\n\n\n\n

                    \"\"<\/figure>
                    \n

                    The request will be imported under the pending folder > Right Click on the certificate and select Issue.<\/p>\n<\/div><\/div>\n\n\n\n

                    \"\"<\/figure>
                    \n

                    The issue certificate will be located under the Issued Certificates folder<\/p>\n<\/div><\/div>\n\n\n\n

                    \"\"<\/figure>
                    \n

                    Select Details and and Copy the file<\/p>\n<\/div><\/div>\n\n\n\n

                    Copying the file is exporting the certificate. This will allow the certificate to be copied over to the Subordinate Server.<\/p>\n\n\n\n

                    \"\"<\/figure>
                    \n

                    Both the Public Root Certificate and the CRL list will need to be copied over to the Subordinate<\/p>\n<\/div><\/div>\n\n\n\n

                    There are three files that need to be copied over to the Enterprise Subordinate,<\/em><\/p>\n\n\n\n

                      \n
                    • The exported Certificate which as been issued for the Subordinate.<\/li>\n\n\n\n
                    • Public Root Certificate\n
                        \n
                      • CRL list<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                          \n
                        • Validity Period<\/li>\n<\/ul>\n\n\n\n

                          Configuring the Enterprise Subordinate CA Part 3<\/strong><\/h3>\n\n\n\n

                          Copy files to IIS location<\/p>\n\n\n\n

                          Clients will need to access the HTTP location to confirm and validate certificate information. This location will need to be will need to contain the 1) The Public Root Certificate 2) the CRL list. Both file are copied into the CertEroll location of the IIS Web Server.<\/p>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Open IIS > Right Click on CertEnroll and select explore<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Copy both Root Public Certificate and CRL List to the location.<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Open AD CS > Right Click on > All Task > Start Service<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Select Yes > Install the certificate that has been issued by the Subordinate<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Select the certificate<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Trust the Certificate<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          The Service will start and a Green Tick will show the service has started.<\/p>\n<\/div><\/div>\n\n\n\n

                          By default all member servers in the domain will be issued the certificate <\/p>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          This can be confirm by logging on and checking the Intermediate Cert Folder<\/p>\n<\/div><\/div>\n\n\n\n

                          \"\"<\/figure>
                          \n

                          Publish Public Root Cert in AD<\/p>\n\n\n\n

                          Certutil -dspublish -f \"full file path.cer\" RootCA<\/code><\/pre>\n<\/div><\/div>\n\n\n\n
                          \"\"<\/figure>
                          \n
                          Publishing the Public Root Cert in AD will push the cert to all member servers. this can be confirmed by logging on to any member server and checking the Trusted Root Authorities servers<\/p>\n<\/div><\/div>\n\n\n\n
                          \"\"<\/figure>
                          \n
                          The end result is all domain servers will have a complete trusted chain.<\/p>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
                          This guide walks you through deploying a Public Key Infrastructure (PKI) using Microsoft Active Directory Certificate Services (AD CS). It follows the industry-standard two-tier Certificate Authority (CA) hierarchy, providing a secure and scalable foundation for issuing and managing digital certificates. What is PKI? Public Key Infrastructure (PKI) is a framework that uses digital certificates and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-508","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/pages\/508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=508"}],"version-history":[{"count":94,"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/pages\/508\/revisions"}],"predecessor-version":[{"id":893,"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=\/wp\/v2\/pages\/508\/revisions\/893"}],"wp:attachment":[{"href":"https:\/\/cloudvlabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}