In this demonstration, we're going to deploy a standalone root CA.
The name of it, CarvedRockRootCA, we're going to use Server Manager to do this,
and we install and then configure our root CA.
We are on CA1, and we're going to come here to Server Manager.
And under Server Manager, this is a role or a feature.
It's actually a role,
so we're going to click here where it says Add roles and features.
We're going to read all this, and then click on Next.
This is a role‑based feature, not a Remote Desktop installation,
so take the default.
Click Next.
This is the only computer we have out here, so select it.
Click Next.
And it's right up here on the top.
See that?
Active Directory Certificate Services.
We check on it, and then it's going to go through and it's going to say,
hey,
you have a lot of features that need to be installed
along with Certificate Services.
Do you want me to install them?
And we do.
So we'll click down here where it says Add Features, and then click on Next.
Click on Next because it filled in the features that we need,
and then we get a notice saying that once we install this,
we can't go change the name of this server.
We can't go joining this server to a domain.
What that will do is it will break the trust for this root CA.
So, we're going to read this and click on Next.
And here we are with the different services.
This is a good preview of some of the things that we're
going to cover throughout this course.
We have Certificate Enrollment Policy, and each time you check on one of these,
you get a definition or a description over on the right‑hand side.
We have the Enrollment Web Services, Authority Web Enrollment,
Network Device Enrollment, and then finally,
the Online Responder.
Keep in mind, this is a root CA.
We are not going to issue any certificates besides the ones
for subordinate CAs with this machine.
So we only want this one, Certification Authority.
It's checked.
Click on Next.
We go through this preview, and then I'm going to say Install.
This does not take very long at all.
It is not actually configuring our root CA.
It is simply installing the services so that we can install the root CA.
This only takes a moment.
I'm going to go ahead and click on Close here,
and then what we're going to notice once it is installed is right up here,
we're going to have, after it's installed,
a little information warning,
yellow triangle with an exclamation point in the middle of it.
Well, that's going to tell us I installed the services,
however, you need to configure the services in order for this to work.
So let's go ahead and fast forward to this being installed.
And it succeeded.
We can see Installation succeeded on ca1.
I'm going to go ahead and close this, and then we simply come back in here and
let me refresh this, and now we have this exclamation point, or the
notification. So I'm going to click on it, and it says Configure Active
Directory Certificate Services on the destination server.
Let's go ahead and click on that.
I'm going to maximize this so you can see it better.
We begin with the credentials.
These are not the domain credentials, these are the
credentials local to this machine.
Now, administrator,
probably not a good idea, you want to secure this. You would want to
have an administrator account with a very strict password because
this server really needs to be secure.
I'm going to take the default.
Click on Next.
The only thing we installed is Certification Authority.
We're good on that.
Click on Next.
This is a Standalone CA, and notice Enterprise CA is grayed out.
That's because this server is not a member of the domain.
So we're ready to click Next.
Is this a root CA or a subordinate CA?
Now,
if this was a subordinate CA, we would have to tell it where the root
CA is located, and we'll go ahead and do that later.
Root CA, check. Click Next.
The type of private key.
If we had an existing key, we could fill that key in here; however,
we want to create a new key for the encryption on this server.
I'm going to click on Next.
We'll take the defaults here, but it's worth taking a look at. SHA256 is
the new standard, and the one thing that has changed,
I'm going to drop this menu down, we have a lot of different encryption methods.
If you see a pound mark,
like right here, RSA#, that means it's a more modern, cryptographic
provider. We'll take the default on that. And the key length, we're going
to go ahead and change the key length here to 4096.
This makes it more compatible and more secure with other systems. Down here,
notice it says Allow administrator interaction when the private key is accessed
by the CA. We're going to check this because we want to come in here and
perhaps make some changes or modifications.
I'm going to click on Next. The CA name, we're going to identify this with the
root CA. So, we'll just call this CarvedRockRootCA. Pretty descriptive. Click
on Next. The validity period, we agreed on five years, the default. Click on
Next. Where to locate the database, and we'll just do it in CertLog. We go
through the confirmation, and then come over here to where it says Configure.
Click on Configure. We get a process indicator telling us the progress of
actually installing the root CA given that it already installed the services.
So this just takes a moment. As you can see, the configuration succeeded.
I'm going to click on Close, and that is how you install the
root CA in Windows Server 2022. Up next, we'll make some configuration changes to this root.