Jump to content

  • 0

How can I configure PKI in a lab on Windows Server 2016 - Part 2


This series is comprised of different parts, listed below.

In part 1 of this series, you configured your LAB for a 2 tier PKI hierarchy running on Windows Server 2016. You used PowerShell to create some virtual machines, and then installed Windows Server 2016,  Windows 10 Enterprise version 1803 and optionally Smoothwall 3.1 before configuring the IP address scheme and Computer Names on the virtual machines. Finally you configured ADDS on DC01 so that you have a working Domain Controller for the rest of this LAB.

In this part you'll install and do initial configuration on the Standalone Offline Root CA.

    What is a Standalone Offline Root CA ?

    If you've never dealt with PKI before you are probably wondering what a Standalone Offline Root CA is and why do you need it. I'll quote the following paragraph from the excellently written article about a Standalone Offline Root CA here. If you don't read the article itself, at least read the Quote below.


    A root certification authority (CA) is the top of a public key infrastructure (PKI) and generates a self-signed certificate. This means that the root CA is validating itself (self-validating). This root CA could then have subordinate CAs that effectively trust it. The subordinate CAs receive a certificate signed by the root CA, so the subordinate CAs can issue certificates that are validated by the root CA. This establishes a CA hierarchy and trust path.

    CA Compromise

    If a root CA is in some way compromised (broken into, hacked, stolen, or accessed by an unauthorized or malicious person), then all of the certificates that were issued by that CA are also compromised. Since certificates are used for data protection, identification, and authorization, the compromise of a CA could compromise the security of an entire organizational network. For that reason, many organizations that run internal PKIs install their root CA offline. That is, the CA is never connected to the company network, which makes the root CA an offline root CA. Make sure that you keep all CAs in secure areas with limited access.

    To ensure the reliability of your CA infrastructure, specify that any root and non-issuing intermediate CAs must be offline. A non-issuing CA is one that is not expected to provide certificates to client computers, network devices, and so on. This minimizes the risk of the CA private keys becoming compromised, which would in turn compromise all the certificates that were issued by the CA (1).

    To cut a long story short, you should use a Standalone Offline Root CA because it lowers the possibility of compromise and ensures reliability of your Certificate Authority infrastructure.

    Step 1. Create a CAPolicy.inf file

    Before installing the Standalone Offline Root CA, you should create a CAPolicy.inf to define 'default' settings for CA templates, some of these settings cannot be changed later and you want them in place before creating any certificates on the Standalone Offline Root CA.


    The CAPolicy.inf is a configuration file that defines the extensions, constraints, and other configuration settings that are applied to a root CA certificate and all certificates issued by the root CA. The CAPolicy.inf file must be installed on a host server before the setup routine for the root CA begins. When the security restrictions on a root CA are to be modified, the root certificate must be renewed and an updated CAPolicy.inf file must be installed on the server before the renewal process begins (2).

    So now that you know that you should create the file as a first step, let's go and do that. On the #11_RootCA virtual machine (RootCA), login as Administrator using the password specified.

    Open an administrative command prompt and type the following:

    notepad C:\Windows\CAPolicy.inf

    and press ENTER, when prompted to create new file, click Yes. Paste in the following text into the new CAPolicy.inf file.

    Signature="$Windows NT$"

    Once done, save the file.

    Note: Any misspellings or mistakes will be ignored, so please copy/paste carefully. To understand what these values are, and why you are using them please see the following link, but in a nutshell, you are telling the CA that by default the Root CA should issue certificates that are valid for 20 years, feel free to adjust accordingly if you think it's appropriate but be aware of the consequences (having to re-issue certificates etc.).

    create capolicy inf file.png

    I'd recommend your verify that the file is indeed correctly named and in the C:\Windows folder. You don't want .TXT appended to it or it will be ignored. To verify, do the following:

    dir C:\Windows\Capolicy.*

    dir capolicy.png

    The file has the right name and is in the right location.

    Step 2. Install Active Directory Certificate Services

    Now that you've created the CAPolicy.inf file you are ready to install Active Directory Certificate Services on the Standalone Offline Root CA. To do so, open Server Manager and select Add Roles and Features.

    add roles and features.png

    Click Next and select Role-based or feature-based installation.

    role based or feature based.png

    Click Next and Select Select a server from the server pool, ensure that ROOTCA is selected.

    select a server from the server pool.png

    Click Next and select Active Directory Certificate Services from the choices available on the Select server roles page, if prompted to Add features that are required for Active Directory Certificate Services, click Add features.

    add features that are required.png

    And here you see the Active Directory Certificate Services role is selected. Click Next to continue.


    on the Select features screen, click Next.

    select features.png

    Click Next, On the Active Directory Certificate Services introduction page, read the Things to note before clicking on Next.

    adcs intro.png

    Insure that Certificate Authority is selected

    certificate authority selected.png

    on the Confirmation screen, click on Install.

    install adcs.png

    Wait for the installation progress to finish successfully before clicking on Close.

    adcs feature installed successfully.png

    Click Close to close the wizard.

    Step 3. Configure Active Directory Certificate Services

    After the installation succeeded in the previous step, click on Configure Active Directory Certificate Services on the destination server in Server Manager.

    configure adcs on the destination server.png

    On the Specify credentials to configure role services screen, ensure your credentials are ROOTCA\Administrator and then click Next.

    specify credentials to configure role services.png

    Select the Certificate Authority role to configure… by default it is not selected.

    certificate authority role to configure is selected.png

    Click Next and select Standalone CA

    standalone ca.png

    Click Next and on the Specify the type of the CA select Root CA

    Root CA selected.png

    Click Next. On the Specify the type of private key select Create a new private key and click Next.

    create a new private key.png

    On the Specify the cryptographic options screen pay attention to the settings before clicking Next. For example, ensure that sha-256 is selected as sha-1 is dead (3). The key length defaults to 2048 but only change to 4096 if you are sure it doesn't break communication with your Switches and legacy applications.

    specify the cryptographic options.png

    On the Specify the name for this CA, change Common Name for this CA to suit your needs, for example enter the following

    windows noob Root CA

    but do not change the other values.

    common name for this CA.png

    For more info about the CA Name see here (4).

    Click Next. On the Specify the validity period page, select 20 years instead of the default of 5.


    Every certificate has a validity period. After the end of the validity period, the certificate is no longer considered an acceptable or usable credential. CAs cannot issue certificates that are valid beyond their own validity period. A best practice is to renew the CA certificate when half of its validity period is expired. When installing a CA, you should plan this date and ensure that it is recorded as a future task.

    specify the validity period.png

    Click Next. On the Specify the database locations click Next.

    specify the database options.png

    On the Confirmation screen review the details and change if necessary or if you are satisfied, click Configure.

    adcs configuration confirmation.png

    and you should see Configuration Succeeded. Click Close when done.

    adcs succeeded.png

    Configuring the above with PowerShell

    To configure the above using PowerShell, use the following commands.

    First install the ADCS role

    Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools

    Edit as necessary before running the below (which configures the ADCS role).

    Install-AdcsCertificationAuthority -CAType StandaloneRootCA -CACommonName "windows noob Root CA" -KeyLength 2048 -HashAlgorithm SHA256 -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" -ValidityPeriod Years -ValidityPeriodUnits 20 -Force

    That's it for this part, in Part 3 you'll configure the Web server for CDP and AIA Publication.

    Recommended reading

    (1) - https://social.technet.microsoft.com/wiki/contents/articles/2900.offline-root-certification-authority-ca.aspx

    (2) - https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/prepare-the-capolicy-inf-file

    (3) - https://blogs.technet.microsoft.com/askpfeplat/2015/03/15/sha-1-deprecation-and-changing-the-root-cas-hash-algorithm/

    (4) - http://go.microsoft.com/fwlink/?LinkId=218063

    Share this post

    Link to post
    Share on other sites

    0 answers to this question

    Recommended Posts

    There have been no answers to this question yet

    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.

    Answer this question...

    ×   Pasted as rich text.   Paste as plain text instead

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.


    • Create New...

    Important Information

    We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.