Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet).

We have our (internal, domain limited) Root CA installed. I would like to take the Root CA offline to secure storage but before that I'd like to setup an intermediate CA which can take over actual live, online (int-RA-net) functionality

How can I do the above? I assume a complete answer would cover

  • creating the intermediate CA certificate request
  • installing the intermediate CA certificate on domain controller (certification authority role already installed with Root CA online right now)
  • use the intermediate CA to generate a certificate (any use certificate, just for demonstration purposes)

Obviously this certification chain would be invalid on computers outside our domain (self trusted root - our root certificate is NOT from common 3rd parties). This last point is NOT a problem.

  • 3
    Is your Root CA installed on a domain joined server or in a workgroup? If it's an Enterprise Root CA (domain joined) then you can't really take it offline since it will be listed in the Enrollment Services container meaning it's selectable by Users or Computers requesting and issuing certificates. Ideally it should be configured as a standalone root CA and you'd create additional enterprise (domain joined) issuing CAs which have signed CA certificate issued by the root CA. – Lewis Oct 11 '12 at 12:43
  • It is a domain joined root CA and the same box also performs other functions. In theory couldn't I a) create the root cert b) remove CA role, move root cert offline, reinstall CA role c) provide the offline root CA to assign newly installed role (on same machine) to now make it an intermediate CA? d) move the root cert offline again Now all certificate requests would be handled by the intermediate CA? – DeepSpace101 Oct 11 '12 at 22:09
  • Ran into technet.microsoft.com/en-us/library/hh831348.aspx but seems a bit excessively involved ... – DeepSpace101 Oct 12 '12 at 2:43
  • 4
    Nobody said installing a proper CA hierarchy was easy :) Depending on how well used the CA is, I would be tempted to decommission it properly (that includes revoking all currently issued certificates) – Lewis Oct 12 '12 at 12:43

I recently went through the process of migrating from an Enterprise Online Root CA to a two tier PKI. Generally the process you will want to follow will contain these steps:

  1. Provision a server that will not be joined to your domain and Install Active Directory Certificate Services. Configure it as a standalone offline root certificate.
  2. Publish your Root CA to the forest.
  3. Provision a second server online and domain joined. Configure that as your intermediate Certificate Authority.
  4. Create a CSR from your intermediate CA and go through the process of issuing a cert from your offline root CA.
  5. Migrate the Certificate templates to the new Intermediate CA and remove the templates from your original PKI. (This will only start issuing new certs from your Intermediate CA NOT invalidating certs issued from your original CA.)
  6. From here you can decide to leave your old CA up until all certs expire or go through the process of forcing your network systems to re-enroll on the new PKI.

The Directory Services Team at Microsoft has a nice high level walkthrough for this.

For more in depth information, here is the walkthrough I followed.

Additionally, here is a Technet Guide and some planning information on the process.

  • 1
    “While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.” – Jacob Jul 14 '14 at 23:46
  • 1
    @Jacob Thanks for the tip. I'll be more thorough in the future. Edited to include more descriptive steps. – Byron C. Jul 15 '14 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.