Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The main issuing (Enterprise) CA should have a certificate signed by the root CA.

Is this possible with just 1 Windows Server 2012 installation or do you really need to create multiple VM's with one CA each?

share|improve this question
up vote 7 down vote accepted

You can only have one AD CS certificate server at a time on a single instance of Windows Server OS.

Edit: Also if you want to get serious about the physical security of the root CA, don't make it a VM. A VM can be booted up from the VM management console and then compromised. Make it a physical machine, use it to set up your policy CAs and issuing CAs, then pull the Ethernet cable out of the root CA machine and power it off. (Which you can't really do with an enterprise (AD-integrated) CA, but that's a whole different topic.)

share|improve this answer
That said, you can use virtualization, as the OP says. A CA is VERY small - I run some on less than 512MB memory. – TomTom Dec 31 '12 at 17:35
@TomTom That may be true but an Offline Root CA is not really "Offline" if its VM files are sitting on an Online storage area. Sure, it may not be powered off but its virtual disks can still be modified and compromised via a number of different methods. – New Guy Dec 31 '12 at 21:24
Export. store on burned blue ray, done. – TomTom Dec 31 '12 at 22:07
"A VM can be booted up from the VM management console and then compromised.". The idea is to backup the VM to secure offline storage and then delete it from the host :) – dtech Jan 1 '13 at 0:01
Right... I shouldn't have worded my response in that way to imply that a VM is completely inappropriate for use as a CA, off or online. It can certainly be a VM. But the discussion was outside the scope of OP's question and as such I didn't put much forethought into my original wording. – Ryan Ries Jan 1 '13 at 0:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.