Installing Active Directory Certificate Services (AD CS)

Microsoft Active Directory Certificate Services (AD CS) is a platform that provides services for issuing and managing public key infrastructure (PKI) certificates. These digital certificates are used in securing HTTPS connections, authenticating devices and users on a network etc. This service has been introduced in Windows Server 2000, and since Windows Server 2008 R2, AD CS is available as a server role in Server Manager. More details about AD CS are available in this link.

In this article, I will be covering the steps to enable “Active Directory Certificate Services” in Windows Server 2012 R2. As a prerequisite, the computer on which you are installing AD CD must be joined to a domain where Active Directory Domain Services (AD DS) is installed. Please refer to my medium article on “Installing Active Directory on Windows Server 2012 R2” to learn how to install AD DS on your Windows Server.

In Server Manager, go to Manage, and click Add Roles and Features. It opens the Add Roles and Features Wizard. Click Next.

Note: If you have previously selected to skip this page by default, you will be going to the next page directly

In Select Installation Type, select Role-based or feature-based installation and click Next.

Select “Select a server from the server pool”. In Server Pool, ensure that the local computer is selected and click Next.

Select Active Directory Certificate Services from Roles.

You will be prompted to add required features. Click Add Features and then click Next.

In Select Features, click Next.

Read the information in Active Directory Certificate Services page and click Next.

In Role Services, select Certification Authority, and click Next.

Note : The use of different role services are as follows. You may select one or many of these features based on your requirement.

• Certification Authority : used to issue certificates to users, computers, and services, and to manage certificate validity.
• Certificate Enrollment Policy Web Service : allows users and computers to retrieve information about their certificate enrollment policy.
• Certificate Enrollment Web Service : allows external clients who are not part of the domain network to connect to a CA via Web browser to request certificates.
• Network Device Enrollment Service : allows routers and other network devices that do not have domain accounts to obtain certificates.
• Online Responder : receives and processes requests on the status of the certificates and sends back signed responses containing requested certificate status information.

In Confirmation page, click Install to install the roles, role services, or features on the server.

The installation process will start.

When the installation is completed, click on the link Configure Active Directory Certificate Services on the destination server.

When the AD CS Configuration wizard opens, read the credential information, and insert credentials of an account of a member of the Enterprise Admins group if needed. Then click Next.

Click Certification Authority and click Next.

Select Enterprise CA as the setup type of the CA. Click Next.

Select Root CA as the type of the CA. Click Next.

Verify that Create a new private key is selected. Click Next.

On Cryptography for CA page, keep the default settings for cryptographic provider, key length, and hash algorithm.

Note : You may change the key length for your deployment, however while larger lengths provide higher security, they may impact the server performance at the same time.

On CA Name page, enter a Common name for this CA to identify the CA. Keep Distinguished name suffix values as default.

Note : The common name is added to all certificates issued by the CA. You cannot change it after you have installed AD CS. Therefore, make sure that the name meets all your naming conventions and purposes.

Select a validity period for the certificate generated for the CA.

Specify locations for Certificate database and Certificate database logs.

Note : It is recommended to leave these as defaults

Finally, click Configure to apply the configurations shown in the page.

Then click Close to finish the wizard.

Now Active Directory Certificate Services have been successfully installed in your Windows Server.

In the next article, I will walk through the process of exporting the Active Directory certificate which can be imported to any server that requires secure communication with the Active Directory.