Capítulo 1 de 8
The certification authority and its optional role services, and what each one adds.
Unos 12 minutos de lectura
Active Directory Certificate Services (ADCS) is a Windows Server role that turns a server into a certification authority. At its core it does one job: sign certificates and keep records of what it signed. Everything else around it — web pages, device protocols, status responders — is an optional way of asking the CA to do that job.
| Role service | What it adds | Security note |
|---|---|---|
| Certification Authority | Issues and manages certificates | Core role; its key is the highest-value asset |
| Web Enrollment | Browser-based request submission | Frequent NTLM relay target; often unnecessary |
| Network Device Enrollment (NDES) | SCEP enrolment for devices | Needs a challenge password and careful policy |
| Online Responder | OCSP status responses | Must stay reachable for the certificate lifetime |
| CEP / CES | Policy and enrolment over HTTPS for remote clients | Adds an internet-facing surface |
Only the Certification Authority role is required. Every extra role service is another listening service, another configuration surface, and another thing to patch — so install only what an actual requirement justifies.
ADCS has two personalities. An enterprise CA is joined to Active Directory and uses certificate templates, so issuance can be policy-driven and automatic. A standalone CA works without a domain and usually requires an administrator to approve requests.
| Characteristic | Enterprise CA | Standalone CA |
|---|---|---|
| Directory integration | Required | None |
| Templates | Available | Not used |
| Typical role | Issuing CA for users and computers | Offline root, or isolated issuing |
| Approval model | Policy-driven, often automatic | Manual by default |
That diversity is the source of its risk. A single CA commonly issues credentials that can authenticate as users and computers, so a template mistake is not a certificate problem — it is an identity problem.