A Windows Server Certificate Authority (CA) lets you issue and manage SSL certificates internally — for internal websites, encrypted RDP connections, Wi-Fi authentication, and code signing. This guide covers installing Active Directory Certificate Services, issuing your first certificate, and distributing the root certificate to clients so they trust it automatically.
Why Run Your Own CA
Public certificate authorities charge per certificate and require domain validation. An internal CA lets you issue certificates for any internal hostname, including servers not publicly accessible. Once your CA root certificate is trusted by clients (pushed via Group Policy), every certificate you issue is trusted automatically — no browser warnings.
Enterprise CA vs Standalone CA
- Enterprise CA — integrated with Active Directory. Can auto-enrol certificates to domain computers and users. This is the right choice for most domain environments.
- Standalone CA — no AD integration. Suitable for DMZ servers or issuing certificates in environments without AD.
This guide covers the Enterprise CA setup, which is the most common and most powerful option.
Installing Active Directory Certificate Services
Install on a domain member server (ideally not a domain controller):
Install-WindowsFeature AD-Certificate, ADCS-Cert-Authority, ADCS-Web-Enrollment, RSAT-ADCSAfter installation, configure the CA:
- In Server Manager, click the notification flag → Configure Active Directory Certificate Services
- Use domain admin credentials
- Select Certification Authority and optionally Certification Authority Web Enrollment
- Select Enterprise CA
- Select Root CA (this is your first CA — if you already have a root, choose Subordinate)
- Select Create a new private key
- Choose RSA 2048 (minimum) or 4096. SHA-256 hash algorithm.
- Set a CA common name (e.g.
CompanyName-CA) - Set validity period — 5 years is typical for an internal root CA
- Accept default certificate database locations
- Click Configure
Distributing the Root Certificate
Domain computers will automatically trust your new CA because setup pushes the root certificate to the NTAuth store in AD. However, verify it’s deployed via Group Policy:
- Open Group Policy Management
- Edit the Default Domain Policy
- Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities
- Import your CA certificate here if it’s not already present
Once applied, all domain computers will trust certificates signed by your CA — no browser warnings.
Certificate Templates
Enterprise CAs issue certificates based on templates. Templates define the key usage, validity period, and who can enrol. Open Certificate Templates Console (certtmpl.msc) to view available templates.
To make a template available for issuance:
- Open the Certification Authority console (certsrv.msc)
- Right-click Certificate Templates → New → Certificate Template to Issue
- Select the template and click OK
Common templates to enable: Web Server (for IIS SSL), Computer (for machine authentication), User (for user certificates).
Requesting a Certificate for a Web Server
On the server running IIS:
- Open IIS Manager → click the server → Server Certificates
- Click Create Domain Certificate in the Actions pane
- Fill in the common name (e.g.
intranet.company.local), organisation details - Click Next → select your CA from the list
- Give the certificate a friendly name → click Finish
The certificate is issued immediately (Enterprise CA) and appears in the Server Certificates list. Bind it to your HTTPS site in IIS bindings.
Auto-Enrolment with Group Policy
For computer and user certificates, configure auto-enrolment so certificates are issued and renewed automatically:
- Edit a GPO applied to the target computers/users
- Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies
- Double-click Certificate Services Client – Auto-Enrollment
- Set to Enabled, tick both checkboxes (renew expired and update)
Computers will request and renew certificates at the next Group Policy refresh.
Managing the CA
Key management tasks in certsrv.msc:
- Issued Certificates — view all certificates currently valid
- Pending Requests — manually approve or deny pending requests
- Revoked Certificates — revoke compromised certificates
- Publish CRL — right-click Revoked Certificates → All Tasks → Publish (update the Certificate Revocation List after revoking)
Backing Up the CA
Back up the CA private key and certificate — without this you cannot re-issue certificates if the server fails:
certutil -backup C:\CA-Backup -p YourBackupPasswordStore the backup securely offline. Treat the CA private key with the same care as any critical credential.
