Why Build an Internal CA?
An internal Certificate Authority (CA) allows you to issue and manage digital certificates for computers, users, and services within your own organization. Unlike public certificates (which you must purchase), internal certificates are free and automatically trusted by all machines joined to your Active Directory domain. This is essential for securing internal web servers, encrypting Wi-Fi with 802.1X, and enabling secure VPN connections.
Step 1: Install the AD CS Role
Log in to your Windows Server as an Enterprise Administrator. Open Server Manager and click Add roles and features. Navigate to the Server Roles page and check the box for Active Directory Certificate Services (AD CS). Click Next until you reach the Role Services page. Ensure Certification Authority is selected (and optionally, Certification Authority Web Enrollment if you want users to request certificates via a web browser). Complete the installation.
Step 2: Configure the Certification Authority
After the installation finishes, a yellow warning icon will appear in Server Manager. Click it and select Configure Active Directory Certificate Services on the destination server.
In the configuration wizard, select the AD CS role services you installed. On the Setup Type page, select Enterprise CA (this integrates the CA with Active Directory). On the CA Type page, choose Root CA.
Step 3: Create the Private Key
When prompted to specify a private key, select Create a new private key. Leave the cryptographic provider at its default (RSA with a 2048-bit key length and SHA256 hash algorithm), as this provides a strong balance of security and compatibility.
Step 4: Define the CA Name and Validity Period
Specify the common name for your CA (e.g., Corp-Root-CA). This name will appear on all issued certificates. Set the validity period for the certificate generated for this CA (the default is 5 years, which is standard for a Root CA).
Click through the database location screens and hit Configure.
Step 5: Verify the CA Operation
Once configuration is complete, open the Certification Authority console from the Server Manager Tools menu. You will see your new CA listed with a green checkmark indicating it is running.
Because it is an Enterprise CA, Windows will automatically publish the Root CA certificate to Active Directory. The next time domain-joined computers refresh their Group Policy, they will automatically download and trust this CA, allowing you to seamlessly issue certificates across your network.