Why Build an Internal CA?
Modern web browsers instantly block access to websites and administrative interfaces (like vCenter or iLO) if they do not have a valid SSL/TLS certificate. While you must purchase public certificates from authorities like GoDaddy or DigiCert for your public-facing websites, doing so for hundreds of internal company servers is extremely expensive and logistically difficult. Active Directory Certificate Services (AD CS) allows you to build your own internal Certificate Authority. Your Domain Controllers will automatically push your root certificate to all employee PCs, meaning any certificate you generate internally will be automatically trusted by every computer in your company.
Step 1: Install the AD CS Role
It is best practice to install the CA on a dedicated member server, not on a Domain Controller.
Log in to your dedicated server, open Server Manager, and launch the Add roles and features wizard.
Check the box for Active Directory Certificate Services. On the Role Services screen, ensure Certification Authority is checked. Complete the installation.
Step 2: Configure the CA
Once installed, a yellow warning triangle will appear at the top of Server Manager. Click it, and select Configure Active Directory Certificate Services on the destination server.
Provide Domain Admin credentials. Check the box to configure the Certification Authority.
On the Setup Type screen, you must select Enterprise CA (this requires the server to be joined to the domain, and is what allows automatic certificate deployment to your users). Choose Root CA as the CA type.
Select Create a new private key. Ensure the cryptography is set to at least RSA#2048 and SHA256.
Step 3: Define the CA Name and Validity
The wizard will ask for a Common Name for your CA. By default, it uses Domain-ServerName-CA. You can change this to something more professional, like Corp-Internal-Root-CA.
Set the validity period. Because this is the root CA, set it to a long duration, such as 10 Years. (If this certificate expires, every single certificate it ever issued will instantly become invalid). Click Configure to finalize the setup.
Step 4: Distribute the Root Certificate via GPO
Because you chose an Enterprise CA, Active Directory will actually do this automatically for you. However, to ensure all clients receive it quickly, you can verify it in Group Policy.
Open Group Policy Management on a Domain Controller, and edit the Default Domain Policy.
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. You should see your new Corp-Internal-Root-CA certificate listed here. If not, you can manually import the .cer file generated by your CA server.
Step 5: Issue a Certificate
To request a certificate for an internal web server (e.g., an IIS intranet portal), log into that web server, open the IIS Manager, click on Server Certificates, and select Create Domain Certificate.
Fill out the organization details. When prompted for the Online Certification Authority, click Select. Your new Corp-Internal-Root-CA will appear in the list. The CA will instantly issue the certificate, and IIS will bind it. When an employee navigates to that intranet site, their browser will show a green padlock because their PC implicitly trusts your new root CA.