<\/p>\n Start the Server Manager<\/strong> and click op Manage<\/strong> and select Add Roles and Features<\/strong><\/p>\n In the blog I’m not installing the\u00a0Certificate Enrollment Web Service<\/strong> because I’m using the Certificates Add-in through mmc.exe to enroll certificates.<\/p>\n Click\u00a0Next<\/strong><\/p>\n Click Next<\/strong><\/p>\n This chapter will describe the configuration of the Microsoft Certificate Authority.<\/p>\n Click on the\u00a0Flag\u00a0<\/strong>and select\u00a0Configure Active Directory Certificate Services<\/strong><\/p>\n Click\u00a0Next<\/strong><\/p>\n Click Next<\/strong><\/p>\n Algorithm: SHA256<\/strong>. SHA1 will be end of life shortly<\/p>\n Click Next<\/strong><\/p>\n Click Next<\/strong><\/p>\n Click\u00a0Next<\/strong><\/p>\n Click\u00a0Next<\/strong><\/p>\n![\"image1\"](\"http:\/\/www.rickroetenberg.com\/wp-content\/uploads\/image1.png\")
<\/a><\/p>\n<\/a>Click Next<\/strong><\/p>\n<\/a>Select\u00a0Role-based or feature-based installation<\/strong> and click\u00a0Next<\/strong><\/p>\n<\/a>Select\u00a0Select a server from the server pool,\u00a0<\/strong>select the server and click\u00a0Next<\/strong><\/p>\n<\/a>Select\u00a0Active Directory Certificate Services\u00a0<\/strong>and enable at least the\u00a0Certification Authority<\/strong>.<\/p>\n<\/a>Windows will install some additional features on the machine to use the Certificate Authority. Click Add Features<\/strong><\/p>\n<\/a>Make sure that\u00a0.NET Framework 3.5 and 4.5 Features is selected<\/strong> and click Next<\/strong><\/p>\n<\/a><\/p>\n<\/a>Select\u00a0Certification Authority\u00a0<\/strong>and click Next<\/strong><\/p>\n<\/a>Click on\u00a0Install.\u00a0<\/strong>The Certificate Authority will be installed shortly.<\/p>\n<\/a>Click on\u00a0Close.\u00a0<\/strong>Restart the server if necessary.<\/p>\n
\nConfiguration<\/strong><\/span><\/h2>\n
<\/a>Start the\u00a0Server Manager<\/strong><\/p>\n<\/a>Full the Credentials<\/strong> box and click\u00a0Next<\/strong><\/p>\n<\/a>Select\u00a0Certification Authority\u00a0<\/strong>and click Next<\/strong><\/p>\n<\/a>Select\u00a0Enterprise CA<\/strong> if you\u00b4re using an Active Directory environment<\/p>\n<\/a>In this case I’m only using an\u00a0root CA, that’s why I’m selected the\u00a0Root CA\u00a0<\/strong>option.<\/p>\n<\/a>Select\u00a0Create a new private key<\/strong> if you don’t have an private key. Else select\u00a0Use existing private key.<\/strong><\/p>\n<\/a>Select\u00a0Key Length: 2048<\/strong><\/p>\n<\/a><\/strong>The above field will be filled automatically. Change the names if you wan’t.<\/p>\n<\/a>Change the CA expiration date<\/strong>\u00a0if you like that<\/p>\n<\/a>Change the database location and database log location if you like that.<\/p>\n