How to Configure Windows Server 2016 Active Directory Certificate Services
Active Directory Certificate Services (AD CS) provides the infrastructure for creating, managing, and distributing digital certificates within an Active Directory environment. Certificates issued by an AD CS certificate authority (CA) are used for a wide range of security scenarios including smart card authentication, SSL/TLS for internal websites, email encryption with S/MIME, EFS file encryption, VPN authentication, and Wi-Fi authentication with 802.1X. Windows Server 2016 includes a fully featured enterprise CA that integrates deeply with Active Directory for automated certificate enrollment and management.
Understanding CA Hierarchy
A well-designed PKI uses a two-tier hierarchy. The Root CA sits at the top of the trust hierarchy and should be kept offline after initial setup to protect the root private key. Subordinate (Issuing) CAs are online and issue certificates to end entities such as users, computers, and services. The root CA only signs the issuing CA certificate and CRL. For small environments, a single-tier (standalone root CA as enterprise CA) may be acceptable, though it is less secure.
Step 1: Install AD CS Role
Install the Certificate Authority role service and management tools:
Install-WindowsFeature AD-Certificate -IncludeManagementTools
Install-WindowsFeature ADCS-Cert-Authority, ADCS-Web-Enrollment, ADCS-Online-Cert, ADCS-Enroll-Web-Svc -IncludeManagementTools
Verify installation:
Get-WindowsFeature | Where-Object { $_.Name -like "ADCS*" } | Select Name, InstallState
Step 2: Configure an Enterprise Root CA
Configure the Certificate Authority role using the Install-AdcsCertificationAuthority cmdlet. An Enterprise CA requires the server to be domain-joined and have access to Active Directory:
Install-AdcsCertificationAuthority `
-CAType EnterpriseRootCA `
-CACommonName "Contoso Root CA" `
-CADistinguishedNameSuffix "DC=corp,DC=local" `
-CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
-KeyLength 4096 `
-HashAlgorithmName SHA256 `
-ValidityPeriod Years `
-ValidityPeriodUnits 10 `
-Force
Verify the CA service started successfully:
Get-Service CertSvc | Select Status, StartType
certutil -ping
Step 3: Configure an Enterprise Subordinate CA
In a two-tier PKI, first install the subordinate CA role, generate a certificate signing request (CSR), submit it to the root CA, and then complete the installation:
Install-AdcsCertificationAuthority `
-CAType EnterpriseSubordinateCA `
-CACommonName "Contoso Issuing CA" `
-CADistinguishedNameSuffix "DC=corp,DC=local" `
-CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
-KeyLength 2048 `
-HashAlgorithmName SHA256 `
-OutputCertRequestFile "C:CARequestsubca.req" `
-Force
Submit the CSR to the root CA and approve the certificate:
certreq -submit -config "ROOTCAContoso Root CA" C:CARequestsubca.req C:CARequestsubca.cer
certutil -installcert C:CARequestsubca.cer
Step 4: Configure Certificate Templates
Certificate templates define the properties of certificates that can be issued. Duplicate built-in templates to create custom ones without modifying defaults:
# List available templates
certutil -CATemplates
# Enable a template for issuance on the CA
Add-CATemplate -Name "WebServer"
Add-CATemplate -Name "Computer"
Add-CATemplate -Name "User"
To create a custom template with auto-enrollment, use the Certificate Templates MMC or via ADSI:
# Duplicate a template using certutil
certutil -setcatemplates +WebServer
# Grant auto-enrollment permissions on a template via PowerShell
$template = [ADSI]"LDAP://CN=WebServer,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule([System.Security.Principal.NTAccount]"Domain Computers", "ExtendedRight", "Allow", [GUID]"a05b8cc2-17bc-4802-a710-e7c15ab866a2")
$template.ObjectSecurity.AddAccessRule($ace)
$template.CommitChanges()
Step 5: Configure Certificate Revocation
The Certificate Revocation List (CRL) allows clients to check whether a certificate has been revoked. Configure CRL distribution points (CDPs):
# View current CRL configuration
certutil -getreg CACRLPublicationURLs
# Set CRL publication URLs
certutil -setreg CACRLPublicationURLs "1:C:WindowsSystem32CertSrvCertEnroll%3%8%9.crln2:http://pki.corp.local/CertEnroll/%3%8%9.crl"
# Set Authority Information Access (AIA) URLs
certutil -setreg CACACertPublicationURLs "1:C:WindowsSystem32CertSrvCertEnroll%1_%3%4.crtn2:http://pki.corp.local/CertEnroll/%1_%3%4.crt"
# Restart the CA service to apply changes
Restart-Service CertSvc
Step 6: Configure Web Enrollment
The Web Enrollment role service provides a web interface for manual certificate requests, useful for non-domain devices or when autoenrollment is not suitable:
Install-AdcsWebEnrollment -Force
# Configure IIS for certificate enrollment
# Access the enrollment page at: https://servername/certsrv
Step 7: Configure Auto-Enrollment via Group Policy
Configure Group Policy to enable automatic certificate enrollment for users and computers:
# Create or edit a GPO for auto-enrollment
# Navigate to: Computer Configuration > Windows Settings > Security Settings > Public Key Policies
# Enable "Certificate Services Client - Auto-Enrollment"
# Via PowerShell, verify auto-enrollment settings
Get-GPO -Name "Default Domain Policy" | Get-GPOReport -ReportType XML | Out-File C:GPOReport.xml
# Force group policy update to trigger certificate enrollment
gpupdate /force
certutil -pulse
Step 8: Manage and Monitor the CA
View issued certificates, pending requests, and CA health:
# View all issued certificates
certutil -view -out "Request ID, Requester Name, Certificate Expiration Date, Certificate Template"
# Revoke a certificate by serial number
certutil -revoke 1A2B3C4D CRLReason_KeyCompromise
# Publish a new CRL immediately
certutil -crl
# Check CA health
certutil -CAInfo
AD CS is the backbone of enterprise PKI on Windows. A properly configured certificate authority enables strong authentication, encrypted communications, and trusted digital identities throughout the organization, forming a critical component of a defense-in-depth security strategy.