Skip to content

Installing AD CS

Installing and Configuring Certificate Services

Active Directory Certificate Services (AD CS) enables organizations to manage digital certificates within their Active Directory environment. Installing and configuring Certificate Services involves deploying a Certification Authority (CA) and customizing its settings to align with security policies. This section outlines the steps to install and configure Certificate Services on a Windows Server.

Prerequisites and Planning

Before installation, ensure the following:
- The server is a domain controller or a member server with access to the domain.
- Active Directory Domain Services (AD DS) is already installed.
- The server has a valid DNS entry and network connectivity.
- Administrative privileges on the domain.

Tip: For enterprise environments, an Enterprise CA is typically used. A Standalone CA is suitable for isolated or test environments.

Installing the Certificate Services Role

  1. Open Server Manager and navigate to Add Roles and Features.
  2. Follow the wizard to add the Active Directory Certificate Services role.
  3. Select Certification Authority as the role, then choose Enterprise CA (or Standalone CA if applicable).
  4. Complete the wizard to install the role.

Example:

Install-WindowsFeature -Name ADCS-Web-Server -IncludeManagementTools

Configuring the Certification Authority

After installation, the Certification Authority (CA) wizard launches. Follow these steps:
1. Set the CA name (e.g., CA01.example.com).
2. Choose the CA type:
- Stand-alone CA: For non-AD environments.
- Enterprise CA: For AD-integrated environments.
3. Configure the certificate database location (default is C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CertSrv).
4. Set the CRL (Certificate Revocation List) distribution point and renewal URL.
5. Approve the CA certificate (required for the CA to issue certificates).

Example:

Set-ADCSAuthority -ValidityPeriod Years -ValidityPeriodUnits 5

Configuring CA Properties

  1. Open the Certification Authority snap-in (Administrative Tools).
  2. Right-click the CA and select Properties.
  3. Configure the following:
  4. Validity period: Define how long certificates issued by this CA are valid.
  5. Key length: Set the cryptographic strength (e.g., 2048-bit RSA).
  6. Certificate templates: Assign templates for different certificate types (e.g., user, computer, code signing).

Example:

Set-ADCSAuthority -ValidityPeriod Years -ValidityPeriodUnits 5

Security Considerations

  • Secure the CA’s private key: Use strong passwords and restrict access to the CA’s administrative tools.
  • Trust the CA certificate: Ensure the CA’s certificate is trusted by clients (install in the Trusted Root Certification Authorities store).
  • Monitor CRL and OCSP settings: Regularly update revocation lists and configure Online Certificate Status Protocol (OCSP) for real-time validation.

Example:

certutil -config "CA01.example.com" -setreg "CRLPublishing" 1

Troubleshooting Common Issues

  • CA installation fails: Check event logs for errors (e.g., missing prerequisites or DNS misconfigurations).
  • Certificates not trusted: Verify the CA’s certificate is installed correctly on client machines.
  • CRL not updating: Ensure the CA’s CRL distribution point is correctly configured and accessible.

Key takeaways

  • Install AD CS via Server Manager or PowerShell, selecting the appropriate CA type.
  • Configure CA properties, including validity periods, key lengths, and certificate templates.
  • Secure the CA’s private key and ensure its certificate is trusted across the network.
  • Regularly monitor and update CRL/OCSP settings for certificate revocation.
  • Use PowerShell cmdlets like Set-ADCSAuthority and certutil for automation and verification.