In this demonstration, we're going to set up DNS and the root certificates.
We're going to add a DNS entry for CA1 because remember, CA1 is a root CA,
and it is not a domain member; it's a standalone server.
And we're going to transfer the CA root certificates to CA2.
We're here in CA1; this is our root Certification Authority.
I have opened an MMC console and added the certificate authority local here.
I'm going to expand this, and here is our Certification Authority.
I'm going to right‑click this, and then go to Properties, and these
are the properties for the certificate authority.
Here is our certificate.
This is the root certificate that the subordinate CAs are going to
use in order to be a subordinate CA to the root.
We come down here to say View Certificate, and we can go to the
Details, and right here, where it says Copy to File,
we click it and then click Next.
This is going to be a DER‑encoded binary X.509. Click Next, and the File name.
We're going to just go ahead and put this on the C drive and call it
CarvedRockRootCA, and click on Save. Click on Next.
Take the defaults, and click on Finish. The export was successful.
Now we just need to come down here, and there it is right there.
I'm going to copy it, and I'm going to paste it into DC1, and I'm going to paste
it into CA2, and let's go to that server. And here we are.
You can see this up here, this is CA2. This is our Certification Authority,
which is a subordinate, and it's going to be an
enterprise‑level certificate authority.
I'm going to come down here, and all we really have to do is paste this.
I'm going to just paste it inside of the C drive.
Here's the C drive, and then we're going to go paste, and there it is.
So we can get to this later.
If we didn't do this before we took our root CA offline,
we have to just bring it back up, so better to do it now.
Let's go to DC1 and do the same thing.
Now we're in DC1, go to File Explorer,
go to This PC, and then just simply paste it in. And
we've completed that part of it.
Now,
what we need to do is go back to CA1 and publish the certificate revocation
list and put that on CA2, so we have that. After we do that,
we have the information from CA1 on CA2 in order to make it subordinate.
Let's go to CA1.
We'll go ahead and get out of the dialog box right there.
Now, on CA1, I'm going to expand this.
See here? Revoked certificates.
I can right‑click on it.
All Tasks, Publish. Here,
it asks you, do you just want the changes to the revocation list, or do you
want a brand new revocation list? And we want a brand new revocation list, so
we're going to click on OK. Now we need to come down here to our File
Explorer, and it is somewhat buried in here.
Once you learn where it is, it's not so bad.
We're going to go to Windows, scroll down to System32.
We have our CertSrv, right here, CertEnroll, and we're going to grab all
three of these, right‑click, Copy, and let's go back to CA2 and paste them
in there. Simply right‑click and then say Paste.
And that is all the moving around that we have to do in order
to have Group Policy and then tell all of our computers and
devices that are on our domain, hey, go ahead and trust CarvedRockRootCA.
We need that certificate in order to do that, and
we'll do that a little bit later.
We also have the revocation list that we need for subordinate CA
in order to certify it with the root CA. So now, we're going to go
to DC1 and DNS. Here we are in DC1.
I'm going to just go down here, type in DNS, and hit Return.
What we need to do is have a record for CA1.
Remember, CA1 is not part of the domain.
You can still get to it, it's on the network, but it's not part of the domain,
so it's not automatically going to have a DNS entry, as a member server would.
So let's go up here to carvedrock.com, expand it, go to our carvedrock.com,
right‑click, New Host record.
The name of this, of course,
is CA1, and the IP address here is 10.1.10.11. Click on Add Host, and
we'll just check that record and make sure it's in here.
There's our DNS. Click on Done first, and here it is, CA1 right here,
10.1.10.11.
So now, with that done,
we're ready to install IIS on our CA2 and configure the GPO policy to trust our Carved Rock root CA.