Active Directory Certificate Services (AD CS) provides a Public Key Infrastructure for issuing and managing digital certificates.
Public Key Infrastructure uses asymmetric cryptography to establish trust.
Understanding the trust chain and certificate validation process.
Certificates serve different purposes, controlled by their Key Usage and Enhanced Key Usage (EKU) extensions.
Enterprise PKI uses a tiered Certificate Authority structure for security and scalability.
The CA type determines how it integrates with Active Directory and handles enrollment.
Active Directory Certificate Services can be installed as multiple role services.
Install the AD CS role first, then configure the CA type in a second step.
Configure this server as an Enterprise Subordinate CA with a 4096-bit key and SHA-256 hashing.
Templates define certificate properties and who can enroll.
List all certificate templates currently published on the CA.
Publish a template on the CA so users and computers can enroll for that certificate type.
Create custom templates by duplicating and modifying existing ones to meet specific organizational needs.
After creating the custom template in the GUI, publish it on the CA so it becomes available.
Multiple methods exist for obtaining certificates from the CA.
Autoenrollment is the most efficient way to distribute certificates at scale in an enterprise.
Trigger certificate autoenrollment immediately instead of waiting for the next policy cycle.
Alternatively, refresh Group Policy which also triggers autoenrollment processing.
Verify which enrollment server URLs are configured on this machine.
The Certificate Authority Web Enrollment role provides a browser-based interface for certificate requests.
Install the Web Enrollment role service and configure it in one sequence.
Submit a certificate request file directly to the CA from the command line.
Revoked certificates must be checked before trusting them.
Revoke a compromised certificate by its serial number with an appropriate reason code.
Publish a new base CRL immediately so clients learn the certificate is revoked.
Clients need to know where to find CRLs and CA certificates to validate the chain.
View the configured CRL Distribution Point and Authority Information Access URLs on the CA.
Test whether a CRL URL is reachable and the CRL can be downloaded.
Validate the full chain for a certificate, including fetching CRLs and OCSP responses.
The Online Certificate Status Protocol provides real-time certificate revocation checking.
Install the OCSP Online Responder role and configure it in one sequence.
Test that OCSP responses work by verifying a certificate with URL fetching enabled.
Windows organizes certificates in logical and physical stores for different purposes.
Browse certificate stores using the Cert: PSDrive, just like navigating a file system.
Find certificates expiring within 30 days so you can renew them proactively.
Encryption certificates may need key recovery if users lose access.
Enable the Key Recovery Agent on the CA so archived keys can be retrieved.
Recover an archived private key in two steps: extract the encrypted blob, then decrypt it.
The certutil command-line tool is essential for PKI administration and troubleshooting.
Display the CA's configuration summary including name, type, and key info.
Verify a certificate's entire chain and fetch CRL/OCSP data to check revocation.
List all certificates stored in the local machine's Personal store.
Convert a Base64-encoded certificate to DER binary format, or export a certificate with its private key.
Group Policy distributes trusted root certificates and configures autoenrollment across the domain.
Publish the Root CA certificate to Active Directory so all domain machines trust it automatically.
Publish the Subordinate CA certificate so clients can build the full certificate chain.
Verify that the CA certificates were successfully published to the AD configuration partition.
The CA database and private key must be protected and backed up.
Back up the CA database, private key, and logs using the PowerShell cmdlet.
Alternatively, use certutil for the same backup operation from the command line.
Restoring a CA from backup requires careful execution to maintain PKI integrity.
Restore the CA database and private key from a backup on the new server.
Alternatively, restore using certutil if the backup was made with that tool.
Immediately publish a new CRL after restore so clients stop using the expired one.
Verify the CA is online and responding to requests after the restore completes.
Practice AD CS configuration through both interfaces.