How to setup Microsoft Active Directory Certificate Services [AD CS]

Microsoft Active Directory Certificate Services [AD CS] provides a platform for issuing and managing public key infrastructure [PKI] certificates. On top of securing application and HTTP traffic the certificates that AD CS provides can be used for authentication of computer, user, or device accounts on a network.

In this post I will be setting up a single AD CS server on my domain and configuring group policy to auto enroll my servers. For an enterprise environment you will deploy subordinate CA’s and shut down your root CA for security. For more information about this setup click here: PKI Design Options

Installing the AD CS Server Role:

Open Server Manager and click Manage -> Add Roles and Features:

Click Next:

Role-based or feature-based installation should be selected then click Next:

Select the server you want to install this role then click Next:

Select Active Directory Certificate Services then click Next:

On the pop up window click the box Include management tools then Add Features:

Click Next:

No additional Features are needed. Click Next:

Click Next:

Select the services you want to enable. At a minimum enable Certificate Authority. Click Next:

A reboot was not required. Click Install:

Once the installation is complete click Close:

AD CS Post-Deployment Configuration:

Back on Server Manager under Notifications click the message Configure the Active Directory Certificate Services on this server:

Select a user account that has the permissions depending on the role services you selected above. Click Next:

In my example I will be configuring the Certification Authority. Click Next:

Since I am on a domain I will select Enterprise CA. Click Next:

Since this is my first PKI server I selected Root CA. Click Next:

Create a new private key then click Next:

Enter your cryptographic options then click Next:

Note: Do not select SHA1 as it is being deprecated by all browsers and Microsoft Server Authentication; use SHA256 instead.

The fields should be pre-populated but you can change the Common name if you wish. Click Next:

Enter a validity period. This is how often the CA certificate will expire and will need to be renew on subordinate CA (if applicable).

Take note of the message: The validity period configured for the CA certificate should exceed the validity period for certificates it will issue.

Click Next:

Advise leaving these as defaults. Click Next:

Ensure the summary is correct then click Configure:

Finished! Click Close:

Create Certificate Template for Workstation and Client Authentication:

This step is to create a certificate template that will enable your domain computers to request certificates from your PKI server.

Open Control Panel then go to Administrative Tools -> Certification Authority:

Right click Certificate Templates then Manage:

Scroll down to Workstation Authentication, right click then select Duplicate Template:

On the General Tab enter a template display name then select a validity period. Click the two boxed options:

On the Security tab add Domain Computers as this will give permission to your Domain Computers. Check the boxes for Read and Autoenroll:

On the Extensions tab click Application Policies then Edit:

Click Add -> Server Authentication then Ok:

Ensure Server Authentication is selected then click Ok:

On the Subject Name tab click the DNS name box to add the DNS name to the SAN of the certificate. Click Apply and Ok:

You will now have a new template with the intended purposes of Client Authentication, Server Authentication. You can now close the Certificate Templates Console window.

Back on the Certification Authority window, right click Certification Template -> New -> Certificate Template to Issue:

Select the Certificate Template we created then click Ok. The custom template should now show under Certificate Templates.

Configure Group Policy for Automatic Certificate Enrollment:

This step is to create the group policy so computer will request a certificate from your PKI server.

On your Domain Controller open Control Panel then Administrative Tools -> Group Policy Management:

You can edit the Default Domain Policy so all computers are configured to request a certificate from your PKI or you can create a policy in a specific OU. I opted to create a new policy for my Windows Servers OU.

Enter a name and click Ok:

Now right click the new policy then click Edit:

Drill down to Public Key Policies. In the right pane right click Certificate Services Client – Certificate Enrollment Policy then Properties:

Change the drop down menu to Enabled then click Apply -> Ok:

Now right click Certificate Services Client – Auto-Enrollment then Properties:

 

Change the drop down menu to Enabled and check the two boxes. Click Apply then Ok. You can now exit the Group Policy Management Editor:

Right click your Policy then click Enforced to enable the policy:

Also right click the OU and click Group Policy Update to accelerate getting the policy pushed out.

Back on your PKI server if you open Certification Authority and go to Issued Certificates you will start seeing your computers have requested and obtained a certificate. If you don’t see anything yet give it some time and refresh later.

You now have a working PKI server in its simplest form. Leave comments below if you had any issues or helpful tips!