I have an Active Directory Domain Controller running the following domain:


I would like to have a wildcard certificate that I could use on any server that has a domain.local address (i.e. is only available locally).

I would also like to create a Group Policy Object to ensure that all domain-connected computers automatically accept the .local wildcard certificate just like they do for *.domain.com certificates (which are issues by real certificate authorities).

Here is what I was thinking: I have installed Active Directory Certificate Authority onto my domain controller thinking that it would be able to create certificates and then I could create the GPO to accept the root authority certificate from this service.

Can I use this role for this purpose? How do I get started? I tried to create a new certificate in ADCS, but it said that something about my CSR was missing information about which "template" to use...

  • I don't have an answer for you right now, but let me point out that you've made two horrible mistakes already and you should fix them before you go much further. – mfinni Dec 14 '16 at 1:16
  • 1. Named an AD domain "domain.local" – mfinni Dec 14 '16 at 1:16
  • 1
    2. Put a CA on a domain controller. – mfinni Dec 14 '16 at 1:16
  • Maybe 3 - you only have one domain controller? – mfinni Dec 14 '16 at 1:17
  • hi @mfinni - the above was just an example - my domain controller is actually replicated locally (once) and also by an Azure Domain Controller (so there are a total of three). I also know all of the arguments against using .local for a domain, but I decided to do it anyways. And 3) - what is the issue with installing a CA on a domain controller? It seems like the two should go hand-in-hand? – William Dec 14 '16 at 1:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.