4

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The main issuing (Enterprise) CA should have a certificate signed by the root CA.

Is this possible with just 1 Windows Server 2012 installation or do you really need to create multiple VM's with one CA each?

1 Answer 1

9

You can only have one AD CS certificate server at a time on a single instance of Windows Server OS.

Edit: Also if you want to get serious about the physical security of the root CA, don't make it a VM. A VM can be booted up from the VM management console and then compromised. Make it a physical machine, use it to set up your policy CAs and issuing CAs, then pull the Ethernet cable out of the root CA machine and power it off. (Which you can't really do with an enterprise (AD-integrated) CA, but that's a whole different topic.)

5
  • That said, you can use virtualization, as the OP says. A CA is VERY small - I run some on less than 512MB memory.
    – TomTom
    Dec 31, 2012 at 17:35
  • @TomTom That may be true but an Offline Root CA is not really "Offline" if its VM files are sitting on an Online storage area. Sure, it may not be powered off but its virtual disks can still be modified and compromised via a number of different methods.
    – New Guy
    Dec 31, 2012 at 21:24
  • 1
    Export. store on burned blue ray, done.
    – TomTom
    Dec 31, 2012 at 22:07
  • "A VM can be booted up from the VM management console and then compromised.". The idea is to backup the VM to secure offline storage and then delete it from the host :)
    – dtech
    Jan 1, 2013 at 0:01
  • Right... I shouldn't have worded my response in that way to imply that a VM is completely inappropriate for use as a CA, off or online. It can certainly be a VM. But the discussion was outside the scope of OP's question and as such I didn't put much forethought into my original wording.
    – Ryan Ries
    Jan 1, 2013 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .