This section provides instructions on the following:
Configuring Microsoft Enterprise Certificate Authority (CA) using Microsoft Network Device Enrollment Service (NDES)
Create a root CA server
The root CA server is the main CA server in any organization, and is the top of the PKI infrastructure. The root CA authenticates the subordinate CA server. This server is generally kept in offline mode to prevent any intrusion and to secure the private key.
To configure the root CA server, do the following:
Make sure that the root CA server is installed. For more information, see Installing the root CA server.
Configure the Certification Distribution Point and Authority Information Access settings. For more information, see Configuring the Certification Distribution Point and Authority Information Access settings.
Configure the CRL accessibility. For more information, see Configuring CRL accessibility.
From Server Manager, click Manage > Add Roles and Feature.
Click Server Roles, select Active Directory Certificate Services and all its features, and then click Next.
From the AD CS Role Services section, select Certification Authority, and then click Next > Install.
After installation, click Configure Active Directory Certificate Services on the destination server.
From the Role Services section, select Certification Authority > Next.
From the Setup Type section, select Standalone CA, and then click Next.
From the CA Type section, select Root CA, and then click Next.
Select Create a new private key, and then click Next.
From the Select a cryptographer provider menu, select RSA#Microsoft Software Key Storage Provider.
From the Key length menu, select 4096.
In the hash algorithm list, select SHA512, and then click Next.
In the Common name for this CA field, type the hosting server name.
In the Distinguished name suffix field, type the domain component.
Machine Fully Qualified Domain Name (FQDN):
Common Name (CN):
Distinguished name suffix:
Click Next.
Specify the validity period, and then click Next.
Do not change anything in the database locations window.
Complete the installation.
In the following deployment scenario, all permissions are based on permissions set on certificate templates that are published in the domain controller. The certificate requests sent to the CA are based on certificate templates.
For this setup, make sure that you have the following:
A machine hosting the subordinate CA
A machine hosting the NDES service
A domain controller
Create the following users in the domain controller:
Service Administrator
Named as SCEPAdmin
Must be a member of the local admin and Enterprise Admin groups
Must be logged locally when the installation of NDES role is triggered
Has Enroll permission for the certificate templates
Has Add template permission on CA
Service Account
Named as SCEPSvc
Must be member of the local IIS_IUSRS group
Must be a domain user and has read and enroll permissions on the configured templates
Has request permission on CA
The subordinate CA server is the intermediate CA server and is always online. It generally handles the management of certificates.
To configure the subordinate CA server, do the following:
Make sure that the subordinate CA server is installed. For more information, see Installing the subordinate CA server.
Configure the Certification Distribution Point and Authority Information Access settings. For more information, see Configuring the Certification Distribution Point and Authority Information Access settings.
Configure the CRL accessibility. For more information, see Configuring CRL accessibility.
From the server, log in as a CAAdmin domain user.
From Server Manager, click Manage > Add Roles and Feature.
Click Server Roles, select Active Directory Certificate Services and all its features, and then click Next.
From the AD CS Role Services section, select Certification Authority and Certificate Authority Web Enrollment, and then click Next.
From the Web Server Role (IIS) Role Services section, retain the default settings.
After installation, click Configure Active Directory Certificate Services on the destination server.
From the Role Services section, select Certification Authority and Certificate Authority Web Enrollment, and then click Next.
From the Setup Type section, select Enterprise CA, and then click Next.
From the CA Type section, select Subordinate CA, and then click Next.
Select Create a new private key, and then click Next.
From the Select a cryptographer provider menu, select RSA#Microsoft Software Key Storage Provider.
From the Key length menu, select 4096.
In the hash algorithm list, select SHA512, and then click Next.
In the Common name for this CA field, type the host server name.
In the Distinguished name suffix field, type the domain component.
Machine Fully Qualified Domain Name (FQDN):
Common Name (CN):
Distinguished name suffix:
In the Certificate Request dialog box, save the request file, and then click Next.
Do not change anything in the database locations window.
Complete the installation.
Sign the CA request of the root CA, and then export the signed certificate in PKCS7 format.
From the subordinate CA, open Certification Authority.
From the left panel, right-click the CA, and then click All Tasks > Install CA Certificate.
Select the signed certificate, and then start the CA service.
From Server Manager, click Tools > Certification Authority.
From the left panel, right-click the CA, and then click Properties > Extensions.
In the Select extension menu, select CRL Distribution Point (CDP).
In the certificate revocation list, select the C:\Windows\system32\ entry, and then do the following:
Select Publish CRLs to this location.
Clear Publish Delta CRLs to this location.
Delete all other entries except for C:\Windows\system32\.
Click Add.
In the Location field, add , where is the IP address of the server.
Click OK.
Select Include in the CDP extension of issued certificates for the created entry.
In the Select extension menu, select Authority Information Access (AIA).
Delete all other entries except for C:\Windows\system32\.
Click Add.
In the Location field, add , where is the IP address of the server.
Click OK.
Select Include in the AIA extension of issued certificates for the created entry.
Click Apply > OK.
From the left panel, expand the CA, right-click Revoked Certificates, and then click Properties.
Specify the value for CRL publication interval and for Publish Delta CRLs Publication interval, and then click Apply > OK.
From the left panel, right-click Revoked Certificates, click All Tasks, and then publish the New CRL.
From IIS Manager, expand the CA, and then expand Sites.
Right-click Default Web Site, and then click Add Virtual Directory.
In the Alias field, type .
In the Physical path field, type .
Click OK.
Right-click CertEnroll, and then click Edit Permissions.
From the Security tab, remove any write access except for the system.
Click OK.
From the server, log in as an SCEPAdmin domain user.
From Server Manager, click Manage > Add Roles and Feature.
Click Server Roles, select Active Directory Certificate Services and all its features, and then click Next.
From the AD CS Role Services section, clear Certification Authority.
Select Network Device Enrollment Service and all its features, and then click Next.
From the Web Server Role (IIS) Role Services section, retain the default settings.
After installation, click Configure Active Directory Certificate Services on the destination server.
From the Role Services section, select Network Device Enrollment Service, and then click Next.
Select the SCEPSvc service account.
From the CA for NDES section, select either CA name or Computer name, and then click Next.
From the RA Information section, specify the information, and then click Next.
From the Cryptography for NDES section, do the following:
Select the appropriate signature and encryption key providers.
From the Key length menu, select the same key length as the CA server.
Click Next.
Complete the installation.
You can now access the NDES server from a web browser as an SCEPSvc user. From the NDES server, you can view the CA certificate thumbprint, the enrollment challenge password, and the validity period of the challenge password.
Open a web browser, and then type , where is the IP address of the NDES server.
From the subordinate CA (certserv), open Certification Authority.
From the left panel, expand the CA, right-click Certificate Templates, and then click Manage.
In Certificate Templates Console, create a copy of Web Server.
From the General tab, type as the template name.
From the Security tab, give the SCEPAdmin and SCEPSvc users the appropriate permissions.
From the Subject Name tab, select Supply in the request.
From the subordinate CA (certserv), open Certification Authority.
From the Extensions tab, select Application Policies > Edit.
Click Add >Client Authentication > OK.
From the left panel, expand the CA, right-click Certificate Templates, and then click New > Certificate Template to Issue.
Select the newly created certificates, and then click OK.
You can now access the templates using the CA web enrollment portal.
Open a web browser, and then type , where is the IP address of the CA server.
In the Certificate template menu, view the templates.
From your computer, launch the registry editor.
Navigate to HKEY_LOCAL_MACHINE >SOFTWARE >Microsoft > Cryptography > MSCEP.
Configure the following, and then set them to MVEWebServer:
EncryptionTemplate
GeneralPurposeTemplate
SignatureTemplate
Give the SCEPSvc user full permission to MSCEP.
From IIS Manager, expand the CA, and then click Application Pools.
From the right panel, click Recycle to restart the SCEP application pool.
From IIS Manager, expand the CA, and then expand Sites > Default Web Site.
From the right panel, click Restart.
From your computer, launch the registry editor.
Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Cryptography > MSCEP.
Set EnforcePassword to .
From IIS Manager, expand the CA, click Application Pools, and then select SCEP.
From the right panel, click Advanced Settings.
Set Load User Profile to True, and then click OK.
From the right panel, click Recycle to restart the SCEP application pool.
From IIS Manager, expand the CA, and then expand Sites > Default Web Site.
From the right panel, click Restart.
When opening the NDES from web browser, you can now only view the CA thumbprint.