Breadcrumbs

Installing AD CS Server role on first cluster node

  1. Join a machine to the Domain and Log in as a user with Administrative privileges

  2. The steps to install the Microsoft Active Directory Certificate Services are same as the Installing Microsoft Active Directory Certificate Services with Windows Enterprise section. After Microsoft ADCS is successfully installed, continue with the below steps

  3. Open the command prompt and run certsrv.msc and then click OK

image-20251110-103823.png

Figure 88: Certificate Authority window

  1. Select the Certificate Authority node in the left pane

  2. In the Action menu, select All Tasks and then select Backup CA

image-20251110-103854.png

Figure 89: Certificate Authority window

If you are using Smartcard Authentication, the prompt will go on the PIN Pad device to insert Smartcard and enter the pin. Then press OK button on the PIN Pad.

  1. On the Welcome page of the CA backup wizard, click Next

  2. Select Private key and CA certificate and provide a directory name where you will temporarily store the CA certificate and optionally the key. Click Next

  3. Provide a password to protect the CA key and click Next

image-20251110-103929.png

Figure 90: Certification Authority Backup window

  1. Click Finish

image-20251110-103949.png

Figure 91: Certification Authority Backup window

You will receive a warning message that the private key cannot be exported. This is expected behavior because the private key will never leave the Utimaco HSM

  1. Click OK to continue

  2. Export the CA Certificate

›_ Console

 
>certutil --ca.cert rootca_certificate.cer

CertUtil: -ca.cert command completed successfully.

  1. Generate MBK and backup of the databases from first node using CryptoServer Administrator Tool (CAT)

image-20251110-104051.png

Figure 92: Remote master Backup Key Management window

  1. Stop the certsvc service. Run:

›_ Console

 
>net stop certsvc