active directory certificate autoenrollment step by step

Take note of the message: The validity period configured for the CA certificate should exceed the validity period for certificates it will issue.Īdvise leaving these as defaults. This is how often the CA certificate will expire and will need to be renew on subordinate CA (if applicable). The fields should be pre-populated but you can change the Common name if you wish. Note: Do not select SHA1 as it is being deprecated by all browsers and Microsoft Server Authentication use SHA256instead. Click Next:Ĭreate a new private key then click Next:Įnter your cryptographic options then click Next: Since this is my first PKI server I selected Root CA. Since I am on a domain I will select Enterprise CA. In my example I will be configuring the Certification Authority. Select a user account that has the permissions depending on the role services you selected above. Once the installation is complete click Close:īack on Server Manager under Notifications click the message Configure the Active Directory Certificate Services on this server: At a minimum enable Certificate Authority. On the pop up window click the box Include management tools then Add Features:

Select Active Directory Certificate Services then click Next: Select the server you want to install this role then click Next: Role-based or feature-based installation should be selected then click Next: Open Server Manager and click Manage -> Add Roles and Features: For more information about this setup click here: PKI Design Options Installing the AD CS Server Role: In this post I will be setting up a single AD CS server on my domain and configuring group policy to auto enroll my servers. For an enterprise environment you will deploy subordinate CA’s and shut down your root CA for security. On top of securing application and HTTP traffic the certificates that AD CS provides can be used for authentication of computer, user, or device accounts on a network. Microsoft Active Directory Certificate Services provides a platform for issuing and managing public key infrastructure certificates.

Active directory certificate autoenrollment step by step