Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet).

We have our (internal, domain limited) Root CA installed. I would like to take the Root CA offline to secure storage but before that I'd like to setup an intermediate CA which can take over actual live, online (int-RA-net) functionality

How can I do the above? I assume a complete answer would cover

  • creating the intermediate CA certificate request
  • installing the intermediate CA certificate on domain controller (certification authority role already installed with Root CA online right now)
  • use the intermediate CA to generate a certificate (any use certificate, just for demonstration purposes)

Obviously this certification chain would be invalid on computers outside our domain (self trusted root - our root certificate is NOT from common 3rd parties). This last point is NOT a problem.

share|improve this question
Is your Root CA installed on a domain joined server or in a workgroup? If it's an Enterprise Root CA (domain joined) then you can't really take it offline since it will be listed in the Enrollment Services container meaning it's selectable by Users or Computers requesting and issuing certificates. Ideally it should be configured as a standalone root CA and you'd create additional enterprise (domain joined) issuing CAs which have signed CA certificate issued by the root CA. –  Lewis Oct 11 '12 at 12:43
It is a domain joined root CA and the same box also performs other functions. In theory couldn't I a) create the root cert b) remove CA role, move root cert offline, reinstall CA role c) provide the offline root CA to assign newly installed role (on same machine) to now make it an intermediate CA? d) move the root cert offline again Now all certificate requests would be handled by the intermediate CA? –  DeepSpace101 Oct 11 '12 at 22:09
Ran into technet.microsoft.com/en-us/library/hh831348.aspx but seems a bit excessively involved ... –  DeepSpace101 Oct 12 '12 at 2:43
Nobody said installing a proper CA hierarchy was easy :) Depending on how well used the CA is, I would be tempted to decommission it properly (that includes revoking all currently issued certificates) –  Lewis Oct 12 '12 at 12:43
add comment

1 Answer

http://www.youtube.com/watch?v=BxErhxEbQcA&feature=plcp is a good video. Start at ep 11 and work your way through the SSL bits.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.