Windows Server 2008 Active Directory Certificate Services (AD CS) Explained
Windows Server 2008 Active Directory Certificate Services (AD CS) is known as Certificate Services in Server 2003. In Server 2003, Certificate Services is installed from ADD/REMOVE Windows components. In Server 2008, Active Directory Certificate Services (AD CS) is installed from +Add Roles. AD CS is a low cost method of issuing digital certificates internally and maintaining a Certificate Authority (CA) infrastructure.
Active Directory Certificate Services Roles
- Enterprise root certification authority
This is the top level, most trusted CA in an organization which should be installed before any other roles. This role should be highly protected as this is a most important role in CA infrastructure. - Enterprise subordinate certification authority
Enterprise subordinate CA can be used to off load work from Enterprise root CA. This CA can issue digital certificates internally but it must get a certificate from Enterprise root CA. - Stand-alone root certification authority
As the name implies, this is the top level CA that is independent from Enterprise root CA. Stand-alone root CA can be deploy for testing or particular purposes. - Stand-alone subordinate certification authority
As the name implies, subordinate CA can be used to off load work from Stand-alone root CA. This CA can issue digital certificates but it must get a certificate from Stand-alone root CA.
How to Install Windows Server 2008 Active Directory Certificate Services (AD CS)
- Open Server Manager
- Click on Add Roles
- Click Next, chose “Active Directory Certificate Services”, click Next, click Next
- Choose required roles services.
- Choose Enterprise CA
- Choose Root CA
- Choose create new private key
- Choose default settings for private key encryption settings
- Choose the name of the CA, example: Organization-RootCA
- Choose 5-year validity period.
- Choose certificate database and log location
- Confirm selections and click Install
After Enterprise root CA is install, it can be managed from Certification Authority console, Start>All
Programs>Administrative Tools>Certification Authority