In this demonstration,
we're going to change the locations of the AIA and CDL files.
We have a distribution list, so if a certificate is revoked,
it should be known because we don't want people using
certificates that have been revoked.
The Authority Information Access is essential that that is available.
We need to add extensions in the properties and then point to a
virtual folder on CA2 in order to make this happen.
We are here on CA1, our root certificate authority.
We're going to come down here and add a snap‑in for the certification authority.
And we do that by going to the Microsoft Management Console,
hitting Return, and then coming up here to where it says File,
Add/Remove Snap‑in.
These are different snap‑ins that you can add that add
functionality to the Microsoft Management Console.
We come here to where it says Certification Authority,
click on Add, it's the Local computer, and then click Finish.
Click OK, and there it is.
I'm going to maximize this so you can see it a little bit better,
and there it is.
We have our CarvedRockCA.
I'm going to expand this, and there are several different folders underneath it.
I'm going to come to CarvedRockCA, right‑click it,
and come down here to Properties.
Under Properties, we have our General information,
and what we're interested in is the Extensions.
We're going to start off with the CRL Distribution Point.
Now, here's why we do this.
This is a root CA.
It is not online once we get done with it,
so it is not going to have a CRL,
it's not going to really publish anything; however,
it still needs to know where it is locally.
So what we're going to do is we're going to take anything
that refers to this server and take it out.
So we have the LDAP, we're going to remove it, click Yes.
We have the HTTP, we're going to remove that, click Yes.
And then we have the file,
individual file within the server that does not have to be accessed,
and click on Remove.
Click Yes.
Now we're going to add a location,
and this location is going to be http / and the name of
our subordinate server is called ca2.
So we have the fully qualified domain name into ca2.
And these will be in a directory called PKI.
So we add that directory inside of our URL,
and we want to include in this the CA name.
So you can see here it says CaName, click on Insert,
we want the CRLNameSuffix, so let's go ahead and find that,
we insert that, and then we need the DeltaCRLAllowed.
So let's go ahead and find that, DeltaCRLAllowed.
I'm going to click on Insert,
and then we put our cursor right here at the end of it.
And the extension on this is going to be .crl.
And we simply come down here to OK and click on it.
We want to include the CRLs because clients are going to use this and
include in the CDP extension of issued certificates.
Now we can add the file from where people can find the CRL.
So I'm going to say Add.
It is file://\\, the URL, pki, and then the CaName,
CRLNameSuffix, basically it's the same thing that we had before.
And then the DeltaCRLAllowed, it's the same thing that we had before; however,
this is the file that people will gain access to this with.
I'm going to say .crl and then click on OK.
Check Publish CRLs to this location and check Include in the
CRLs and Publish Delta CRLs to this location.
I'm going to click on Apply. Now we're ready for the AIA,
which establishes authority for this server.
We're going to do what we did before. We're going to
remove anything that's kind of local here,
Remove, and remove this one, and then click on Add. And up
here, we have the URL, http, pki/, and then the server DNS
name. Right here click on Insert.
Then we put the cursor up here and we have an underscore, and then
the CaName followed by the certificate name.
CaName, Insert. And then the certificate name right here, Insert.
Put the cursor up here, and this is .crt. Click on OK.
And we want to check this box, Include in the AIA
extension of issued certificates.
We'll have an Online Responder, so we want to check this one too,
Include in the online certificate status protocol, or OCSP
extension, and finally click on Apply.
It will have us restart the Certificate Services, and we'll go ahead and do so.
Now this is changing the makeup of the certificates this is
going to dole out. It tells us where the AIA is and where the
revocation list is going to reside.
So this completes the installation of our root CA. It's all ready to go.
It is independent of our domain because, again,
it's a standalone server. I'm going to click on OK.
So that is how you set up your root CA and make the proper changes to it in Windows Server 2022.