This article describes how to build an offline Standalone Root Certificate Authority (CA) with an Enterprise Subordinate CA. You can configure it over Server Manager or with PowerShell. The article describes the way with PowerShell in Windows Server 2019 Server Core.

Go to Part 1 for configuring the Standalone CA: Install an Offline Root CA with an Enterprise Subordinate CA – Part 1

Part 2 – Implement Enterprise Subordinate CA

  1. Basic setup
    1. Installation of Windows Server 2019
    2. IP / DNS Configuration
    3. Change Computer Name
    4. Enable Remote Desktop
    5. Enable Firewall Rules (RDP, Remote Management,…)
    6. Join the server to your domain
  2. Install Active Directory Certificate Authority Role Service:
    Add-WindowsFeature Adcs-Cert-Authority
     
     
    If you want to configure more role services than just the CA you could use this command for all features:
    Add-WindowsFeature AD-Certificate -IncludeAllSubFeature
    Or you can run
    Get-WindowsFeature
    which returns you the available features around Certificate Services
  3. Configure Active Directory Certificate Authority:
    Install-AdcsCertificationAuthority -CAType EnterpriseSubordinateCa -CACommonName Company-IssuingCA
     
     
    1. CAType should be EnterpriseSubordinateCa
    2. CACommonName ist the name of your Issuing CA
    3. There are additional parameters which can be set, the ones mentioned above are the most important, you can first execute the command with -WhatIf switch to check what will be happening
  4. After that command is executed and CA is installed, you will get a warning which is normal:

    WARNING: The Active Directory Certificate Services installation is incomplete. To complete the installation, use the
    request file “C:\servername.domain.ch_Company-IssuingCA.req” to obtain a certificate from the parent CA. Then,
    use the Certification Authority snap-in to install the certificate. To complete this procedure, right-click the node
    with the name of the CA, and then click Install CA Certificate. The operation completed successfully. 0x0 (WIN32: 0)

  5. Copy the generated Certificate request file to your Root CA Server
  6. On the Root CA Server Submit a new Certificate Request
    enterprise_01
  7. Select the certificate request file and complete the wizard
  8. The certificate will now show up in the Pending Requests section (it may take some seconds, refresh)
  9. Right click on the certificate and click all Tasks > Issue
  10. The certificate is now under Issued Certificates
  11. Double click on the issued certificate, navigate to details and click Copy to File…
  12. Select PKCS #7 type, including all certificates in the certification path and save the file under C:\Windows\System32\certsrv\CertEnroll\Company-IssuingCA.p7b
  13. Copy the three files (crl and 2x crt) from Root CA Server (C:\Windows\System32\certsrv\CertEnroll) to Subordinate CA Server (e.g. C:\inetpub\wwwroot\CertEnroll)
  14. Verify the CRL is accessible through the URL you defined in Part 1 (http://crl.domain.ch/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl)
  15. Execute the following commands to Publish the Certificate and CRL to AD
    certutil -dspublish -f C:\inetpub\wwwroot\CertEnroll\RootCAServer_Company-RootCA.crt RootCA
certutil -dspublish -f C:\inetpub\wwwroot\CertEnroll\Company-RootCA.crl
  16. Execute the following command to install the Subordinate CA Certificate
    certutil -installCert C:\inetpub\wwwroot\CertEnroll\Comany-IssuingCA.p7b
  17. Now you should be able to start the the Issuing CA service
  18. Now you can Shutdown the Offline Standalone Root CA
  19. Next possible steps to take:
    1. Distribute the Issuing CA Certificate through GPO (Default domain policy > Computer Configuration >Policies > Windows Settings > Security Settings > Public Key Policies > Intermediate Certification Authorities > Import > Select Certificate from Subordinate CA
    2. Create certificate templates
    3. Install additional components like Online Responder, Web Enrollment,…
    4. …