Microsoft PKI – Single Tier Server (Graphical Setup)

If you have not already read the first page in this MS PKI series, 
you should do so before continuing.

The following is useful for setting up a single ADCS PKI server in a very small environment such as a lab. It provides instructions using the standard graphical interface that most people use in the MS world. It uses LDAP for all publishing the CDP/AIA points to computers that are only on the domain.

 If HTTP is needed to publish CRL/AIA, it must be on a different server (Maybe, I’ve had issues getting CRL/AIA publishing to work on the same server).  The requirements can be used from the “Two Tier” setup instructions located on a different page.

Note that a single tier PKI is not typically appropriate in a production environment.

A second page is provided elsewhere that uses a mixture of command line instructions, both PowerShell and the certutil interfaces, for building and configuring the server.

Build up the server and add to the domain.

Copy CAPolicy.inf to C:\windows  (%systemroot%) of root CA server. A simple minimal example is provided below. You must do this step prior to installing the CA role.

Warning:  If creating a new replacement issuing (including single tier) server, use the CAPolicy.inf with the “LoadDefaultTemplates=0” line added.  When server is ready to issue, manually add the certificate templates.

CAPolicy.inf example for Root CA:

Signature=”$Windows NT$”

Install CA Role:

Enterprise root CA
"Certification Authority"

Configure ADCS:

"Certification Authority"
"Enterprise CA"
"Root CA"
"Create Private Key"   -- RSA default is ok,key length 4096, SHA256
"Common name"          -- Not the same name as the server
"Validity period"      -- Should be set by CAPolicy.inf, or equal to.

After complete, check the certificate with MMC CertSRV.  It should match above settings.

Post Install Configuration:

Open command prompt as administrator. Don’t make these too short if using LDAP. Consider OCSP instead.

NOTE: There are many settings. These are pretty minimal.

Certutil -setreg CA\CRLPeriodUnits 1 
Certutil -setreg CA\CRLPeriod "Weeks" 
    --Next two if CRL Deltas are used (which I usually don't on single tier testing server) 
Certutil -setreg CA\CRLDeltaPeriodUnits 1 
Certutil -setreg CA\CRLDeltaPeriod "Days"

Add the CDP and AIA points:

From Server Manager:

"Certification Authority" (MMC CertSRV) 
"Extensions" tab

Don’t screw these up or you have to start over because issued certs will be bad.

Add CDP (CRL Distibution Point):

Click ADD, use as examples and add LDAP path utilizing “Variable” and Insert.


ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>

Check "Publish CRL's to this location","Include in CRL's", "Include in the CDP extentions of issued certificates"

Remove default ones except C:\windows (standalone - so no file, ldap, anyway) 
    -- or -- 
Uncheck all boxes for each. 

Add AIA  (Authority Information Access):

Click ADD, use as examples and add LDAP path utilizing “Variable” and Insert.

ldap:///CN=<CATruncatedName>,CN=AIA,CN=Public Key Services,CN=Services,<ConfigurationContainer><CAObjectClass>

Check "Include in the AIA of issued certificates"

Remove default ones except "C:\windows\System32\CertSrv\CertEnroll\<ServerDNSName>_<CaName><CertificateName>.crt
   -- or -- 
Uncheck all "Publish/Include" boxes for each. 

Restart the Service and Publish CRL (certutil -crl):

Restart certificate services to activate this configuration in a PowerShell window:

restart-service certsvc
R-click "Revoked Certificates"
All Tasks, Publish

C:\Windows\System32\CertSrv\CertEnroll – .crl’s date modified should change when CRL is published.

Check PKI health:


Also check “Manage AD Containers” from the pkiview menu.

If CA Object Access Auditing is needed, see the page here.