- [Instructor] There's a role in Windows Server
that has been around for quite awhile
and is still one of the most
underutilized roles in my opinion,
and that's the Active Directory Certificate Services role.
Encrypting data and verifying the identity of users
and computers can be done using certificates.
Certificates serve as a kind of ID card
that verifies the identity of whoever presents it
and for any type of ID to be useful.
It needs to come from a trusted authority.
Drivers licenses and passports need to be issued
by the government agency trusted to issue them.
Certificates need to be issued by an entity
that can be trusted to vouch for the user
or the computer's identity.
Within Active Directory,
you have the ability to issue certificates
that will be recognized by everyone
that trusts your internal authority.
These certificates won't be as useful
to outside entities, but they're incredibly helpful
when you want to quickly verify identity
for remote PowerShell sessions,
application access from a mobile device
or any number of other scenarios.
You can install this role from the server manager,
as I've done here or from the Windows Admin Center
or from PowerShell on any server.
Whether it's a member of a domain or not.
But it's easier to issue certificates that will be trusted
by Active Directory if you install this on a member server.
I've already installed the role on this server
and here I am prompted to configure
Active Directory Certificate Services on this machine.
So I'm going to go ahead and follow that link.
The first thing that I'm asked to specify
is the account that has the credentials necessary
to make enterprise and domain wide changes.
The administrator for my domain fits that bill,
so let me go ahead and move forward
and configure the certification authority.
As we create our own public key infrastructure
there is a hierarchy, and this can be done in an enterprise
or in Active Directory
or as a stand alone certificate authority.
This is Active Directory so I'm going to create
an enterprise CA and move on to the next screen
where we start creating the hierarchy.
The Root CA and there's only one per Active Directory forest
this sits at the top of the hierarchy.
So this is what I'm going to install.
If you're going to install one authority,
this is the one you need to pick.
Once this has been created and configured.
You can install multiple subordinate CAs
to issue certificates based on the authority of the root.
Let me go ahead and move on and show you some of the options
that you can choose as you configure
a new certificate authority.
You have the opportunity to create a new private key
for this certification authority.
Which is usually what you want to do.
If you're replacing a previous certificate authority
you may want to use the key from that,
from that authority that's already known
and trusted in your domain.
In the next screen, you get to specify things that will
effect the security of your certificates.
What hash algorithm, what level of encryption
is going to be involved in your certificates,
how long will the key be, which cryptographic provider
is appropriate for your needs.
All of these are settings that you can choose
while you're installing the server.
The name of the certificate authority,
which will be recognized in Active Directory
is offered up to you and you can change this if needed,
and finally you can specify the maximum duration
of the validity of the certificates that you issue.
They can be shorter than this,
but whatever you specify here this is the max length.
This is the longest certificate that you can issue.
Many things like user certificates
or computer certificates are only going to be valid
for a year at a time so that they can be renewed regularly
and checked up on, but five years as an overall
for the server is going to be fine for me at this point.
The certificate database is going to be created,
this is a local instance that is similar
to SQL but not exactly.
This is where the certificates
and records of them are going to be stored,
and now I can confirm all of my choices
and click OK and it will go ahead
and set up a certificate authority
that I can use in my domain.
You can see that this configuration
doesn't take long at all.
If your network is not yet running
its own public key infrastructure
consider the security benefits
and the cost savings of using this Active Directory tool
to vouch for your users, as well as your servers.