Breadcrumbs

Installing AD CS Server Role on First Cluster Node

  1. Join a machine to the Domain and log in as a user with Administrative privileges.

  2. The steps to install the Microsoft Active Directory Certificate Services are the same as those in the Installing Microsoft Active Directory Certificate Services with Windows Enterprise section. After Microsoft AD CS is successfully installed, continue with the steps below.

  3. Open the command prompt and run certsrv.msc, and then click OK.

image-20250805-105825.png


"Certificate Authority" Window

  1. Select the Certificate Authority node in the left pane.

  2. In the Action menu, select All Tasks and then select Backup CA.

image-20250805-105858.png


"Certificate Authority" Window

If you are using smartcard authentication, the prompt will appear on the PIN Pad device to insert the smartcard and enter the PIN. Then, press the OK button on the PIN Pad.

  1. On the Welcome page of the CA backup wizard, click Next.

  2. Select Private key and CA certificate, and provide a directory name where you will temporarily store the CA certificate and, optionally, the key. Click Next.

  3. Provide a password to protect the CA key and click Next.

image-20250805-110040.png


"Certification Authority Backup" Window

  1. Click Finish.

image-20250805-110133.png


"Certification Authority Backup" Window

You will receive a warning message that the private key cannot be exported. This is expected behavior because the private key will never leave the Utimaco HSM.

  1. Click OK to continue.

  2. Export the CA Certificate.

›_ Console

 
>certutil --ca.cert rootca_certificate.cer 
CertUtil: -ca.cert command completed successfully.

  1. Generate the MBK and backup of the databases from the first node using the CryptoServer Administrator Tool (CAT).

image-20250805-110509.png


"Remote Master Backup Key Management" Window

  1. Stop the certsvc service. The following command can be executed to accomplish this.

›_ Console

 
net stop certsvc