Active Directory Certificate Services

A certification authority signs certificates. Around it, optional role services provide enrolment and revocation interfaces. An enterprise CA integrates with Active Directory and certificate templates; a standalone CA works without a domain and is often used for an offline root.

• Two tiers are the norm: an offline root and a domain-joined issuing CA
• The root signs rarely, so its key stays offline in an HSM
• Issuing CAs carry the operational load and the monitoring burden

A template decides who may enrol, what the subject may contain, which purpose the certificate serves, and whether an administrator must approve the request. Most ADCS incidents are template and permission problems rather than cryptographic ones.

• Read exposes the template, Enroll allows requesting it, Autoenroll distributes it by policy
• Duplicate a template to get a version 2 template with subject and EKU control
• Supply in request lets the requester choose the subject name, which is dangerous with client authentication
• Manager approval turns issuance into an explicit decision
• Archive keys only for encryption templates, never for signing-only keys

Autoenrollment is what makes ADCS pleasant and dangerous at the same time: policy-driven issuance means one template change reaches thousands of principals at the next policy refresh.

• Group Policy delivers templates to users and computers and renews before expiry
• NDES handles devices that cannot use domain enrolment, protected by a challenge password
• CEP and CES extend enrolment to non-domain and remote clients over HTTPS
• Test template changes in a pilot OU before linking them broadly

Revocation data must be reachable by every client that validates the certificate, including clients outside the domain. That makes CDP and AIA URLs a design decision rather than a default.

• CDP points at CRLs, AIA points at the issuer certificate
• Publish CRLs with overlap so a late file never breaks validation
• Delta CRLs keep clients fresh between full publications
• The Online Responder serves OCSP for clients that prefer it
• Monitor CRL age and distribution reachability like any other dependency

Published ADCS attack paths are catalogued as ESC issues. Each one turns a configuration mistake into certificate impersonation, and each has a matching control.

• Audit template permissions, CA flags and web endpoints together, not in isolation
• Treat any template that can authenticate as a domain credential
• Re-run the assessment after every template or role change

A CA is a long-lived service. Its backup, audit and retirement plan decide how much trust you can safely place in it over time.

• Back up the CA database, CA certificate and private key with HSM export controls
• Audit issuance logs for unexpected subjects, templates and request sources
• Publish issued certificates to AD only when discovery is intended
• On decommission, publish final CRLs and keep revocation data for the certificate lifetime
• Document the PKI, including trust anchors, so the next team can operate it