AD CS PKI FAQ

This article presents a list of common questions and answers related to Active Directory Certificate Services (AD CS) and Public Key Infrastructure (PKI).

Table of Contents

Where should I post my AD CS questions?

If you need an answer that is not covered on this page or linked to by this page, you will probably get it quickest through search. However, if you cannot find the answer, you can post your certificate services questions to the Windows Server Security Forum (http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads). Please, be sure to search the forum before posting, to see if that question has already been answered in another thread. If you find that you've got a commonly asked question and answer, please, add it to this article.

Return to Top

Which blogs should I follow for AD CS?

Return to Top

Where can I find more information about AD CS Events in the Event Viewer?

There are several places to look, depending on your operating system version. The resources by supported operating system are:
Return to Top

What are the changes for AD CS between Windows Server 2008 and Windows Server 2008 R2?

The following resources elaborate on the differences between the two server versions:

Return to Top

Will you post any videos on Active Directory Certificate Services?

There are a couple already posted. Return to Top

How do I install AD CS Windows Server 2008 R2 on Server Core?

There is a document that specifically addresses installing AD CS on Windows Server 2008 R2 Server Core:

Windows Server editions prior to Windows Server 2008 do not support Server Core installation. If you are running Windows Server 2008 R2, then you should also review the Edition Comparison by Server Core Installation Option, to see if your edition supports running AD CS on Server Core.

Return to Top

Which firewall ports need to be opened for Active Directory Certificate Services?

There is a PKI blog entry that covers this information titled Firewall Rules for Active Directory Certificate Services.

Return to Top

Can I have my root CA certificate issued by a trusted third-party CA?

No, because a root certification authority (CA), by definition signs its own certificate. If you want another entity (trusted third-party CA) to sign your CA certificate, then you will, by definition, have a subordinate CA. Depending on your business requirements, you may want to consider using cross-forest trusts or utilize a third-party managed CA service as well. A few documents that may help you figure out the type of PKI design you want include:
Return to Top

Can wild card characters be used with SSL certificates?

Microsoft's Cryptographic Application Programming Interface 2 (CAPI2) allows wildcards for the leftmost name component in the Fully Qualified Domain Name (FQDN). However, the behavior is a bit more restrictive than RFC 2818 specifies, the logic used for Microsoft's CAPI2 wildcards are expanded upon in Microsoft Knowledge Base article 258858 "Accepted wildcards used by server certificates for server authentication."

Return to Top

What happens to any computer certificates issued to computers that are disabled or deleted in Active Directory?

If the computer (also called device or machine by some) is deleted, disabled, or disconnected after the certificate is issued, the certificate remains in Certification Authority console and in Active Directory. Eventually, the certificate will expire since it cannot be renewed.

Return to Top

Is a CA name change supported when migrating from one OS version to another?

No. The only supported method for migrating a certification authority (CA) from one operating system (OS) version to another is to maintain the same CA name. A host name change is supported, but the CA name must stay the same. Reference http://technet.microsoft.com/library/cc742466.aspx in the Supported Migrations table.

Return to Top

What should I do about the error "The requested certificate template is not supported by this CA 0x80094800 (-2146875392)). Denied by Policy Module 0x80094800?"

The error "Certificate enrollment failed to enroll for a DigitalSignature certificate with request ID 43 from <caname>. (The requested certificate template is not supported by this CA 0x80094800 (-2146875392)). Denied by Policy Module 0x80094800?"can occur if targeted user group does not have access to Enroll or if targeted computer or user accounts do not have access to read a Group Policy Object (GPO) distributing the policy. Ensure that Authenticated Users or targeted group of users and computers has Read access to the GPO. See also Troubleshooting Certificate Autorenewal in Active Directory Certificate Services (AD CS) and Troubleshooting (Advanced Certificate Enrollment and Management).

Return to Top

Is the Simple Certificate Enrollment Protocol (SCEP) or the Network Device Enrollment Service (NDES) supported by Windows Server 2003 editions?

Yes, there is a SCEP Add-On for Windows Server 2003 called Microsoft Simple Certificate Enrollment Protocol (MSCEP).

Return to Top

Is the Online Responder OCSP supported by Windows Server 2003 editions

No, the Online Responder was introduced with Windows Server 2008 in the Enterprise and Datacenter editions only. For more about the differences between versions and editions of AD CS, see the table in the Active Directory Certificate Services Overview.

Return to Top

Does Enterprise PKI (PKIView) support OCSP?

Yes, the Microsoft Management Console (MMC) Enterprise PKI (PKIView), supports the  When setting up Certificate Extensions, you must ensure that the Include in the AIA extension of issued certificates is not selected. That option is located in the Extensions tab of the CA Properties in the Certification Authority console. The correct configuration for an http path specifying the AIA for an Online Responder is shown in the following figure.

Return to Top

How does a certificate services client select the certification authority from which to enroll or renew?

Starting with Windows Vista, the process goes:
1. A list is built containing the CAs that support the relevant template and for which the client has enroll permission.
2. The list is sorted randomly.
3. After that, each CA in the list is tried in order until one responds.
To load-balance CAs or control where clients enroll and renew, you can use the enroll permissions on the templates and CAs themselves. The client computers are not Active Directory Domain Services (AD DS) site aware.
Return to Top

Can an OCSP provider (Online Responder) support multiple certification authorities that reside in different forests?

Yes. In order for this to work the Online Responder needs is a certification authority (CA) certificate, a signing certificate, and access to the certificate revocation list (CRL). 
Return to Top

When S/MIME certifiates are issued by AD CS, is there any automatic way to publish the S/MIME certificate for the Exchange GAL?

You can configure a template on the CA to be published to the user account when its published (http://technet.microsoft.com/en-us/library/cc730861.aspx). This in turn makes it available for Outlook to use.
Return to Top

Is there a way to delete expired certificates from a certificate database without placing them in the certificate revocation list (CRL)?

Yes, you can compact the CA database. See http://blogs.technet.com/b/askds/archive/2010/08/31/the-case-of-the-enormous-ca-database.aspx for more information.

Return to Top

How should I build and maintain my offline certification authorities (CAs)?

See the TechNet Wiki articles specific to building and maintaining offline CAs. They are:

Return to Top

How many Subject Alternate Names (SANs) are supported?

A CA running on Windows Server can support an extension of 4096 bytes, which is where the Subject Alternate Names (SANs) are placed. Any request that exceeds that limit will be rejected and no certificate will be issued.

Return to Top

Can I cluster the Online Responder (OSCP) role?

Yes, you can use a Network Load Balancing (NLB) cluster. For details, see Implementing an OCSP Responder: Part V High Availability.

Return to Top

Additional PKI Resources

Return to Top