Updating the CA Configuration in Active Directory

1. Log on to the Domain Controller with enterprise permissions.

2. Click the Start button, open Run, and type dssite.msc and then click OK.

3. Select the top node in the left pane.

4. In the View menu, select Show services node.

5. In the left pane, select the Services and Public Key Services, and then select AIA.

"Active Directory Sites and Services" Window

6. In the middle pane, select the CA name as it shows in the Certification Authority MMC Snap-in.

7. In the Action menu, select Properties.

8. Click Security.

9. Click Add.

10. Select Object Types, then select Computers, and then click OK.

11. Type the computer name(s) of the other cluster node(s) as the object name and click OK.

12. Make sure that the computer accounts of all cluster nodes have Full Control permissions.

13. Click OK.

14. All cluster nodes also have to be permitted on the Enrollment Services container.

15. In the left pane, select Enrollment Services.

16. In the middle pane, select the Certificate Authority name.

17. In the Action menu, select Properties. Select the Security tab and click Add...

18. Select Object Types, select Computers, and click OK.

19. Type the computer name(s) of the all-cluster node(s) as the object name.

20. Make sure that the computer accounts of all cluster nodes have Full Control permissions.

21. Click OK.

22. In the left pane, select KRA.

23. In the middle pane, select the Certificate Authority name.

24. In the Action menu, select Properties, then select the Security ta,b and click Add.

25. Select Object Types, select Computers, and then click OK.

26. Type the computer name of all cluster nodes as object names and click OK.

27. Make sure that the computer accounts of all cluster nodes have Full Control permissions.

28. Click OK.