In the near future I will be tasked with building a Tier 2 ADCS PKI that uses HSM's, can anyone tell me what I have to do differently when building the PKI, and how the HSM fits into the whole PKI? (Win 2016 or Win 2019 Server) I have a lot of experience with building tier 2 ADCS PKI's but I've never worked with HSM's before.


The HSM is used to protect the private key of your CA server. The main difference is you will need to use the HSM vendor cryptographic provider when installing the CA service so the private key is not stored directly on the CA.

This page may provide better information on the topic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.