Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2003 AD and I set up a root ca and a sub ca both of which are windows 2008(joined to domain).I need to use the sub ca to generate end user certificates for digital signature , they should be able generate from the url (self enroll). Can someone advice if I can get this done?

a. without schema update on ad? ad 2003 to ad 2008

b. or rather make them stand alone ? will the templates work this way ?

share|improve this question

No you dont need a schema extension to use the 2008 CA. See AD Schema Requirements for Windows PKI features.

You are better off using an enterprise subordinate than a standalone subordinate. However it is common to use a standalone root CA.

PKI is something you should plan before you implement (rather than attempt to retrofit later). You might be put off by the amount of documentation out there. Nevertheless, I suggest you review the documentation starting with content on the AskDS blog where Microsoft support engineers post.

See Designing and Implementing a PKI: Part I Design and Planning and other accopanying blogs in series to get a good intro into designing your corp PKI implementation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.