Step -By-Step Procedure To Set Up An Enterprise Root CA On Windows Server

When you start setting up a Root CA for your PKI infrastructure, two things will come up to your mind, Standalone or Enterprise Root CA. Both CAs have their own advantages over each other. Both are build for different purpose. If you want to know more about the Standalone Root CA, we published a dedicated post covering Standalone Root CA, and we also covered the comparation (Standalone vs Enterprise Root CA) in a different post. However, let’s limit this post to only Enterprise CAs. Let’s see a step-by-step procedure to set up an Enterprise Root CA in ADCS with a list of requirements and benefits of setting up an Enterprise Root CA in the PKI infrastructure.

What Is An Enterprise Root CA In ADCS?

An Enterprise Root CA in ADCS is a type of Certificate Authority that is used to issue digital certificates to organizations within an enterprise. The Enterprise Root CA is typically installed on a server that is located within the organization’s internal network.

The Enterprise Root CA is responsible for issuing digital certificates to all other types of CAs within the enterprise and issuing digital certificates to devices and users connected to the enterprise network. The Enterprise Root CA can be used to issue digital certificates for SSL/TLS encryption, email security, code signing, and more.

Organizations that use an Enterprise Root CA usually have a high level of security and require a higher degree of trust for their digital certificates. As such, the Enterprise Root CA is typically more expensive and difficult to install and maintain than other types of CAs.

Why You Should Set Up An Enterprise Root CA In ADCS?

An Enterprise Root Certificate Authority (CA) is a top-level CA that is trusted by everyone in the organization. The Enterprise Root CA is typically installed on a domain controller and integrated with Active Directory Domain Services (AD DS).

As the highest level of authority in the PKI hierarchy, the Enterprise Root CA issues and signs certificates for all other CAs in the PKI. In turn, these other CAs issue and sign certificates for devices, users, and applications. By having a centralized Enterprise Root CA, organizations can more easily manage security and access control.

An Enterprise Root CA provides a number of advantages over a Standalone Root CA, some of them are:

Requirements To Set Up Enterprise Root CA In ADCS:

How To Set Up An Enterprise Root CA On Windows Server?

Step 1: Set up Active Directory Certificate Service (ADCS) Role- Open the ‘Add Roles and Features’

Let’s begin this process by setting up the ADCS role. Open the ‘Add Roles and Features’.
In Server Manager, go to Manage –> Add Roles and Features

Step 2: Select Role-Based Installation

Click the Next button in the ‘Add Roles and Features’ wizard.
Select a Role-based or Feature-based installation since it is a role-based
Click Next.

Step 3: Select the Server on which you are going to install the ADCS Role

Since it has only a local server, select that local server then click Next.

Step 4: Select the ‘Active Directory Certificate Services’ role

Select “Active Directory Certificate Services” role then click on Next.

Step 5: Add the ‘Add Features’

Click on the ‘Add Features’ button to add the ADCS features.
Click on Next, and Next again.

Step 6: Initiate the ADCS installation process

Click on Next, and Next again. This will take you to the ADCS installation wizard.
Click the Next button to initiate the ADCS installation process and Add Features for Web Enrollment.

Step 7: Select ‘Certificate Authority’ and ‘Certification Authority Web Enrollment’ roles

You will be greeted with multiple options to choose from.  Select the first  and fourth options ‘’ and ‘Certification Authority Web Enrollment’ roles then click Next.

Step 8: Since we are installing Web Server Roll (IIS) with Default Role services click Next.

Step 9: Begin the installation of ‘Certificate Authority’ and ‘Certification Authority Web Enrollment’ roles

Click on the Install button to begin the installation of ‘Certificate Authority’ and ‘Certification Authority Web Enrollment’ roles.