Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet).
We have our (internal, domain limited) Root CA installed. I would like to take the Root CA offline to secure storage but before that I'd like to setup an intermediate CA which can take over actual live, online (int-RA-net) functionality
How can I do the above? I assume a complete answer would cover
- creating the intermediate CA certificate request
- installing the intermediate CA certificate on domain controller (certification authority role already installed with Root CA online right now)
- use the intermediate CA to generate a certificate (any use certificate, just for demonstration purposes)
Obviously this certification chain would be invalid on computers outside our domain (self trusted root - our root certificate is NOT from common 3rd parties). This last point is NOT a problem.