I know that when an Active Directory domain is created:
- it creates its own root certificate
- and that root certificate is automatically pushed into machines when they are joined to the domain
You can find this domain certificate in your Trusted Root Certification Authorities store:
e.g. our domain's self-signed cert is valid for 50 years.
Can this cert sign others?
The question is: Can this trusted root certificate be used as a trusted root certificate?
I want to have other certificates that are used by other services (e.g. SQL Server Use Encryption for Data certificate) that is automatically trusted by all machines on the domain.
- Is there any way to sign a certificate with the AD root certificate?
- Is it possible to have the AD controller generate trusted certificates?
Certificate Services
I know that Microsoft has a product called Active Directory Certificate Services.
- I believe this service creates it's own root certificate (independent of the Active Directory Domain root certificate) that,
- I believe that this root certificate is not signed by the domain's root certificate
- and I believe that you have to push this certificate yourself out to machines on the domain (e.g. using a login script, a group policy, or manually).
Obviously that's not what I'm asking about. I'm asking about using the domain's trusted root certificate to sign other certificates so that they are trusted automatically.