AD CS Complete Architecture Guide: Designing Enterprise Microsoft PKI

Active Directory Certificate Services has been the backbone of enterprise PKI since Windows Server 2003. Two decades later, it still issues the majority of internal certificates in Fortune 500 environments — domain controller certs, user authentication, Wi-Fi (802.1X), VPN, code signing, and device identity. Yet most AD CS deployments were set up by someone who clicked “Next” through a wizard ten years ago, and nobody has touched the architecture since.

This guide covers how AD CS should be designed — not just installed — for an enterprise that needs to scale, survive audits, and eventually migrate to modern alternatives.

AD CS Role Services

AD CS isn’t a single service. It’s a collection of role services that work together:

Architecture Patterns

1-Tier Architecture (Don’t Do This in Production)

A single CA that is both root and issuer. The root CA private key is online and exposed to the network.

When it’s acceptable: Lab environments, proof-of-concept, isolated test networks.

Why it fails in production: If the single CA is compromised, your entire PKI is destroyed with no recovery path. You can’t rotate the root without re-issuing every certificate in the environment.

2-Tier Architecture (Standard Enterprise)

The recommended minimum for production:

Design decisions:

3-Tier Architecture (High-Security / Regulated)

Adds a Policy CA layer between root and issuing CAs:

When to use 3-tier:

• Government / defense (FISMA, CNSA requirements)
• Financial services with strict separation of duties
• Organizations with multiple business units needing independent policy control
• Cross-certification with external PKI hierarchies

Offline Root CA Setup

The root CA is the trust anchor for your entire PKI. It must be protected accordingly.

Installation

# On a standalone (non-domain-joined) Windows Server Core
# Install CA role
Install-WindowsFeature -Name ADCS-Cert-Authority -IncludeManagementTools

# Configure as standalone root CA
Install-AdcsCertificationAuthority `
  -CAType StandaloneRootCA `
  -CACommonName "Contoso Root CA" `
  -KeyLength 4096 `
  -HashAlgorithmName SHA256 `
  -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
  -ValidityPeriod Years `
  -ValidityPeriodUnits 20

Root CA Configuration

# Set CRL and AIA distribution points
# These URLs must be reachable by clients, even though the root CA is offline
# Publish CRL to a web server or AD

# Configure CRL publication interval (6 months for root — it's offline most of the time)
certutil -setreg CA\CRLPeriodUnits 6
certutil -setreg CA\CRLPeriod "Months"
certutil -setreg CA\CRLOverlapUnits 2
certutil -setreg CA\CRLOverlapPeriod "Weeks"

# Configure AIA (Authority Information Access)
# Remove default LDAP (root is not domain-joined)
certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://pki.contoso.com/CertEnroll/%1_%3%4.crt"

# Configure CDP (CRL Distribution Point)
certutil -setreg CA\CRLPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://pki.contoso.com/CertEnroll/%3%8%9.crl"

# Set maximum certificate validity the root CA will issue (for subordinate CAs)
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"

# Restart the CA service
Restart-Service certsvc

# Publish the initial CRL
certutil -CRL

Exporting Root CA Certificate and CRL

After configuring the root CA, export its certificate and CRL to distribute to the domain:

# Copy root CA cert and CRL to USB drive for transport to domain
# (Root CA has no network — use removable media)
Copy-Item "C:\Windows\system32\CertSrv\CertEnroll\*.crt" "D:\RootCA\"
Copy-Item "C:\Windows\system32\CertSrv\CertEnroll\*.crl" "D:\RootCA\"

On a domain-joined server, publish to AD and the web server:

# Publish root CA cert to AD (all domain machines will trust it)
certutil -dspublish -f "D:\RootCA\Contoso Root CA.crt" RootCA

# Publish root CRL to AD
certutil -dspublish -f "D:\RootCA\Contoso Root CA.crl"

# Copy to web server for HTTP CDP/AIA
Copy-Item "D:\RootCA\*" "\\pki-web\CertEnroll\"

Enterprise Issuing CA Setup

The issuing CA handles day-to-day certificate operations. It’s domain-joined and online.

Installation

# On a domain-joined Windows Server
Install-WindowsFeature -Name ADCS-Cert-Authority, ADCS-Web-Enrollment -IncludeManagementTools

# Generate CSR for the root CA to sign
Install-AdcsCertificationAuthority `
  -CAType EnterpriseSubordinateCA `
  -CACommonName "Contoso Issuing CA 01" `
  -KeyLength 4096 `
  -HashAlgorithmName SHA256 `
  -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
  -OutputCertRequestFile "C:\IssuingCA-Request.req"

Sign the Issuing CA Certificate (On Root CA)

# Transport the .req file to the offline root CA via USB

# On the root CA — submit and issue the request
certreq -submit "D:\Requests\IssuingCA-Request.req"
# Note the Request ID (e.g., 2)

# Issue the certificate
certutil -resubmit 2

# Retrieve the signed certificate
certreq -retrieve 2 "D:\Signed\Contoso Issuing CA 01.crt"

Install the Signed Certificate

# Back on the issuing CA server — install the signed cert
certutil -installcert "D:\Signed\Contoso Issuing CA 01.crt"

# Start the CA service
Start-Service certsvc

Configure Issuing CA Settings

# Set CRL publication (daily for issuing CA — it's online)
certutil -setreg CA\CRLPeriodUnits 1
certutil -setreg CA\CRLPeriod "Days"
certutil -setreg CA\CRLOverlapUnits 8
certutil -setreg CA\CRLOverlapPeriod "Hours"

# Enable Delta CRLs (for large environments)
certutil -setreg CA\CRLDeltaPeriodUnits 12
certutil -setreg CA\CRLDeltaPeriod "Hours"

# Configure AIA and CDP
certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11\n3:http://pki.contoso.com/CertEnroll/%1_%3%4.crt"

certutil -setreg CA\CRLPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n6:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10\n2:http://pki.contoso.com/CertEnroll/%3%8%9.crl"

# Set maximum validity for issued certificates
certutil -setreg CA\ValidityPeriodUnits 2
certutil -setreg CA\ValidityPeriod "Years"

# Enable auditing
certutil -setreg CA\AuditFilter 127

# Restart
Restart-Service certsvc
certutil -CRL

# View template permissions
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com" `
  -Filter { Name -eq "WebServer" } -Properties nTSecurityDescriptor |
  Select-Object -ExpandProperty nTSecurityDescriptor |
  Select-Object -ExpandProperty Access

# Key rules:
# 1. Only grant Enroll to groups that NEED the template
# 2. Never grant Enroll to "Authenticated Users" on sensitive templates
# 3. Use "Autoenroll" permission separately from "Enroll"
# 4. Require CA manager approval for high-value templates (code signing, CA certs)

# Check for ESC6 (dangerous flag)
certutil -getreg policy\EditFlags
# If EDITF_ATTRIBUTESUBJECTALTNAME2 is set, disable it:
certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
Restart-Service certsvc

# Audit all templates for ESC1 (SAN in request + broad enrollment)
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com" `
  -Filter * -Properties msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag |
  Where-Object { $_.'msPKI-Certificate-Name-Flag' -band 1 } |
  Select-Object Name

# Use a DNS alias (CNAME) for the HTTP CDP
# pki.contoso.com → load-balanced web servers

# IIS configuration for CRL hosting
# Enable double escaping (required for delta CRL filenames with '+')
Set-WebConfigurationProperty -Filter "/system.webServer/security/requestFiltering" `
  -PSPath "IIS:\Sites\PKI" -Name "allowDoubleEscaping" -Value $true

# Set appropriate cache headers (CRL validity = 1 day, cache for 12 hours)
Set-WebConfigurationProperty -Filter "/system.webServer/staticContent/clientCache" `
  -PSPath "IIS:\Sites\PKI" -Name "cacheControlMode" -Value "UseMaxAge"
Set-WebConfigurationProperty -Filter "/system.webServer/staticContent/clientCache" `
  -PSPath "IIS:\Sites\PKI" -Name "cacheControlMaxAge" -Value "12:00:00"

# Create or edit a GPO linked to the target OU
# Computer Configuration → Policies → Windows Settings → Security Settings →
#   Public Key Policies → Certificate Services Client - Auto-Enrollment

# Settings:
#   Configuration Model: Enabled
#   ✓ Renew expired certificates, update pending certificates, remove revoked certificates
#   ✓ Update certificates that use certificate templates

# Force Group Policy update
gpupdate /force

# Trigger certificate auto-enrollment manually
certutil -pulse

# Check enrolled certificates
certutil -store My

# Check auto-enrollment event log
Get-WinEvent -LogName "Application" -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-CertificateServicesClient-AutoEnrollment']]]" |
  Select-Object -First 10 TimeCreated, Message

# ad-cs-health-check.ps1 — Run daily

# Check CA service status
$caStatus = Get-Service certsvc
if ($caStatus.Status -ne "Running") {
    Write-Warning "CA service is NOT running!"
}

# Check CA certificate validity
$caCert = Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.Extensions | Where-Object { $_.Oid.Value -eq "2.5.29.19" -and $_.CertificateAuthority } }
$daysToExpiry = ($caCert.NotAfter - (Get-Date)).Days
if ($daysToExpiry -lt 180) {
    Write-Warning "CA certificate expires in $daysToExpiry days!"
}

# Check CRL validity
$crlPath = "C:\Windows\system32\CertSrv\CertEnroll"
$crlFiles = Get-ChildItem "$crlPath\*.crl"
foreach ($crl in $crlFiles) {
    $crlInfo = certutil -dump $crl.FullName | Select-String "Next Update"
    Write-Output "CRL: $($crl.Name) — $crlInfo"
}

# Check for failed requests in the last 24 hours
$failedRequests = certutil -view -restrict "Disposition=31,Request.SubmittedWhen>=$(Get-Date).AddDays(-1)" -out "RequestID,CommonName,Disposition"
Write-Output "Failed requests (last 24h): $($failedRequests.Count)"

# Check database size
$dbPath = (certutil -getreg CA\DBDirectory).Value
$dbSize = (Get-Item "$dbPath\*.edb" | Measure-Object -Property Length -Sum).Sum / 1GB
Write-Output "CA database size: $([math]::Round($dbSize, 2)) GB"