In this demonstration,
we're going to deploy the subordinate CA, and this one's pretty simple,
we just install and then configure our subordinate CA.
We start off here, this is CA2, our subordinate enterprise server.
I'm going to come down here and just go to Server Manager, type in scr, and
that should do it. And from Server Manager, we're going to add a role and
feature, click on Next. This is role based, Next.
We only have one computer here, that is CA2.carvedrock.com,
click on Next, and it's right up here, the first one, Active
Directory Certificate Services.
We're going to add the features for this, and then click on Next. Click
on Next here through the features, and a few things to note, the name
and domain settings of this computer cannot be changed after a
certification authority has been installed.
We're okay with that, but make sure you've got your name,
you've got your domain, you've got everything in order before you click on Next.
We do, so let's click on Next.
At this point in time,
we're only going to do the certification authority. Click on Next, and then
click on Install, and this will go through, install the services, and then
we have to configure the services after that.
Then there's the next step, and the next step is we have
to go in and certify this particular server that it is a
subordinate to our Root CA.
So it's kind of like three different processes here, and we
just concluded the first process, that's installing the actual
certification authority software.
I'm going to click on Close, and then we can see an exclamation
point here, going to click on it, and then come down to
Configure Active Directory Certificate Services on this
computer, and here it is right here.
We're going to change the credentials, we want this to be an
administrator account on the domain itself, so I'm going to
change this to administrator@carvedrock.com, and then type in
the password, and click on OK.
It goes through and verifies that if we type something
wrong here or got the password wrong, we would receive an error message.
I'm going to click on Next.
We're going to do a certification authority here, and then click on Next again.
You might consider using a specific user account for this, an administrator
account, that just does the certification authority; however,
we're going to just generalize it and use administrator.
This is an Enterprise CA, so we're going to select that, and click Next.
It's not a Root CA, a Subordinate CA, and click on Next.
We're going to create a private key and change this length
to 4096 to be more modern, and Save.
Click on Next, and Common name for this CA. What I'm going to
do is just change this right here to where it says
carvedrockIssueCA, I'm going to click on Next.
This is where we get the request for our particular server.
It's a request file, meaning it is .req, and we can see the name of it
right here, it's CA2.carvedrock.com_carvedrock‑CA2‑CA. We could change
the name of this, but it doesn't really matter.
We're going to click on Next,
take this for the certificate logs, and then click on
Configure. We get a simple warning message, and let me
tell you what this message says.
It says that this is a subordinate CA, you have to certify it
with the Root CA in order for it to function.
So, we know that, and we're going to do that now. I'm going to click on Close.
And there's various ways to have that request file submitted.
What we're going to do is we're going to stay on this computer and go
to the MMC, add a certification authority snap‑in by clicking
Add/Remove Snap‑in, Certification Authority,
click on Add, and that's going to be for another computer.
What this computer will be is CA1. Click on Finish, and then
click on OK. So we're at the certification authority for
CA1, but we're actually on CA2, which is perfectly fine.
I'm going to come here, expand this, and it's going to take a little
bit longer because we're doing this remotely, and there we have it, our
CarvedRockRootCA. Right‑click, All Tasks,
Submit new request, and we put it on the local C
drive, and there it is right there.
I'm going to say Open, and that should put it in Pending Requests. Hit
Refresh, and there it is, we just simply come down here,
go to All Tasks, and say Issue.
We've requested the certificate, it went to pending,
we right‑clicked it, and said issue, and now it's
going to go to Issued Certificates.
So, all we have to do,
let's go to Issued Certificates, and there's our certificate right there.
We're going to say Open, and then go to the Details, and
right here where it says Copy to File, we're going to select that.
Click on Next. This is a Cryptographic Message Syntax
Standard or PKCS #7 certificate.
We want to include all the certificates in the certification
path, and then click on Next. And then the name of the file, and
we can call it pretty much anything.
What I'm going to do is just put this right on the C drive, and we're going to
call this carvedrockCARoot, and then click on Save, click on Next, and then
finally, Finish, and the export was successful.
We can go just check on that real quick.
Here it is right here.
So we sent the request in and got back this, and now we're ready to certify our subordinate CA with the Root CA, and we'll do that, next.