I'm looking for some guidelines toward the best approach to setting up a Tier 2 PKI with ADCS that has 2 subordinate CA's for high availability. I have the following questions regarding this:

  • Is clustering the subordinates the best approach if I want to avoid high complexity? (There are no Load balancers in the enviroment)
  • When would I build in this high availability component? Would I first setup both the subCA's, certify them, and then start to cluster them?
  • How would I need to configure OCSP if I intend to run them on the subordinates that I cluster?

1 Answer 1


There is too little information in your initial question. But if you are looking for a clustered solution then keep in mind, that ADCS doesn't support load balancing. ADCS supports two-node server cluster when only one node is active at any given time.

For ADCS failover cluster implementation in your network I would suggest to read the official Microsoft whitepaper: Failover Clustering and Active Directory Certificate Services. This whitepaper will cover all important aspects of ADCS clustering, preparation and step-by-step installation and configuration.

How would I need to configure OCSP if I intend to run them on the subordinates that I cluster?

you shall not combine ADCS Certification Authority role with any other role. You shall use dedicated server to host OCSP server. In addition, OCSP server shall not be used for CRL distribution points. In a simplest ADCS implementation with OCSP you will need the following separate hosts:

  1. CA cluster node A
  2. CA cluster node B
  3. CRL distribution (any web server will be ok)
  4. OCSP server

If you want to provide OCSP redundancy, you can setup multiple OCSP servers and create an array of OCSP servers. More information on configuring Microsoft OCSP server: Online Responder Installation, Configuration, and Troubleshooting Guide

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .