Windows Server 2022: Active Directory Certificate Services (AD CS) Discussion and Install Guide

Skip straight to the demo at 04:39
See more info by clicking SHOW MORE below!

In this video we'll discuss Active Directory Certificate Services, and then demonstrate and install Active Directory Certificate Services on a Windows Server 2022 Server.

Timecodes:
00:09 - Discussion
04:39 - Demonstration

In this video:

1. Discussion
-SSL Certificates (Host verification)
-Internal Root Certification Authorities (Root CAs)
-Internal Root CA vs Public Trusted Root CAs
-HTTPS Scanning (Web Filtering) and SSL Certificates
-Intermediate Certificate Authorities
-Why ADCS?
-AD CS Certificate Templates
-Encryption
-Certificate Issuance

2. Demonstration
-Server Manager Role Installation
-MMC Snap-in for Certificates (Local Computer)
--Root CAs
-Install Active Directory Certificate Services (AD CS)
--Add Server Role
--Root CA Trust Discussion
--AD CS Installation on Domain Controller Installation
--AD CS Prerequisites
--Web Enrollment Discussion
--AD CS and IIS Discussion
-Install Internet Information Services (IIS) as pre-requisite
-Configure Active Directory Certificate Services (AD CS)
--Credentials
--Role Configuration
--Enterprise CA vs Standalone CA
--Root CA vs Subordinate CA
--Private Key Creation and Cryptographic options
--Root CA Naming
--Validity Period
-Certification Authority MMC Usage
-Root CA Replication to Domain ("gpupdate /force" and restart)
-AD CS Certificate Templates Overview
--Certificate Templates MMC
--Duplicate and Customize Web Server Certificate Template
--Enable Auto-Enrollment for Certificate Template
-Use IIS to request certificate from Active Directory Certification Authority
--Create Domain Certificate
-Enable SSL on WSUS Server using Active Directory Certificate Services Certificate
--Bind new certificate to IIS Web Server
--Update GPO to reflect SSL URL and port number
--Run "iisreset" on elevated command prompt
-Demonstration Summary

This video is part of a multi-video playlist containing howto's on deploying various technologies with Microsoft Windows Server 2022.

Hardware/Software used in this demonstration
-VMware vSphere
-HPE DL360p Gen8 Server
-Microsoft Windows Server 2022
-pfSense Firewall

To hire me and my company, visit:

#Windows #WindowsServer #WindowsServer2022 #WSUS #WindowsServiceUpdateServices #Guide #HowTo #VMware #ESXi #VirtualMachine #Demo #Demonstration #ADCS #Certificates #SSL

[alirezapourranjbar]

i have been looking for a video like this all over. Thanks. this made my day.

[FTABoyNavid]

thanks for the great explanation with example of the usage of certificates.

[RedWollip]

This is a great series of videos. Please keep them coming.

[estebangomez]

man, this video was really well elaborated, i thank you for this my friend!

[vcp]

Your point regarding installing CA Services on an AD DC are true.... for now. However at some point you'll be replacing both the DCs and the CA servers. You may not want to do both upgrades at the same time. In addition, if that DC has a problem, then you now have "two problems". Since most shops use some sort of virtualization for their server infrastructure, keeping your CA servers running on their own VM is probably a better choice. For a testing lab, I'm with you 100%. Good job on your tutorial. Cheers! 👽✌️

[weneedheros]

Really good content. Clear and concise explanations.

[OscarFaustoPelosi]

Very well explained and easy to understand. Thank you, much apreciated

[Albert-North]

Thanks for video. Used it to setup the CA on our domain - but did not see comments about not setting up on a DC in the domain (as those who argued that it should be on a non-domain server that is eventually disconnected from the network):

1) how big of a hassle would it be to move the CA now that it is integrated with (and on) a DC? I see that it has now issued domain certs to all four DC's
in our domain.
2) do we need to manually keep track of the certs issued to the DCs or do they auto-renew in 2 years (since they were auto-created); likewise, do I need to keep track of the expiry for the CA - 5 years out - to have the certificate for the CA itself renewed?
3) what happens if the CA server goes down? I guess the certificate must be "self-contained" enough that even if the CA is down, it can continue to function (up until its expiry date).

Thanks. Albert (from Kincardine, ON - on the shores of Lake Huron)

[fbifido]

@22:48 - you need to tell the CA to make that new template available or to enable it.

[fbifido]

@23:22 - you could have check what certificate was under Personal in the MMC to see which cert was issue to that member machine if any.

[kijkhier]

I dont fully agree with the rootCA on the domain controller. I think you build a separate RootCA and a subordinateCA. Then take the RootCA offline. Then use the Subordinate to sign the requests. Now your RootCA is allways online and can be compromised.

[matthijsleenhouts]

question can i setup a pdc domain a controller en install Active Directory Certificate Services end ras to it end install a ssl certificaat for openvpn server so that clients get a ssl certificaat from the domain if cliens connect on the open vpn server?

[Minerva___]

I’ve seen it mentioned that CAWE was designed with Server 2003-2006 in mind and that is now insecure to use it, with people recommending other methods but I just can’t find more detailed information. For internal only SSL certificates, would the CAWE role still be safe to use for Server 2016 and newer?

[thedonfranz]

question, how would you utilize the newly created web server template? i saw that the one requested on WSUS-IIS is the default web server template. and how would it handle if the certificate expires?

[nxu]

Can you show how a windows CA could issue a full certificate chain to an internal third party non windows service please?

[buweloitacademy]

Hi Steve, I need some input from you regarding AD CS. Is it safe to deploy AD CS in an existing domain enviroment that doesn't have that? What are the recommendations or safety before deploying on a production? Thanks in advance

[maruwing]

Thanks for the video step. Do Windows Server 2022 CA backward compatible to Windows Server 2016 DC ?

[waynesouza]

I have a root CA on my domain and the server OS is aging out. Can I add a second root CA on the domain and have them both run simultaneously until I can remove the old CA server?

[mn]

Useful video, thanks for that. I would appreciate a video showing how to bring up pfSense doing HTTPS-filtering using Squid Guard (as Intermediate CA).

[jamesdanielelliott]

You never issued a certificate using the new template, it was issued with the original template.