Skip the Textbook
Every PKI guide starts with public/private key pairs, asymmetric encryption, and RSA mathematics. That’s great if you’re building a CA from scratch. But if you’re an IT operations team that needs to keep the lights on, you need to know three things:
- What certificates are and what they do in your environment
- What breaks when certificate stuff goes wrong
- What you need to do about it
This post skips the crypto theory and focuses on the operational reality of PKI in an enterprise environment.
What Certificates Actually Do (In Plain Language)
A certificate is a digital ID card. That’s it.
Just like a driver’s license proves you are who you claim to be (verified by the government), a digital certificate proves a server/device/user is who it claims to be (verified by a Certificate Authority).
Physical World: Digital World:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Government issues license → CA issues certificate
License has your name → Cert has server name (CN/SAN)
License has expiry date → Cert has expiry date
License is hard to forge → Cert is cryptographically signed
Bouncer checks your ID → Browser/client checks the cert
Expired license = rejected → Expired cert = connection refusedWhere You See Certificates Every Day
| System | Certificate Purpose | What Breaks Without It |
|---|---|---|
| Company website | Proves it’s really your site | Browsers show “Not Secure” |
| Email (Exchange) | Encrypts mail connections | Outlook errors, mail flow stops |
| WiFi (802.1X) | Proves device belongs to company | Devices can’t connect to WiFi |
| VPN | Proves both sides of tunnel | VPN connections fail |
| Active Directory | Domain controller identity | Logon failures, replication issues |
| Remote Desktop | Proves you’re connecting to right server | RDP cert warnings |
| Internal apps | Encrypts internal traffic | Application connection errors |
| Code signing | Proves software is legitimate | Users get “untrusted publisher” warnings |
The Three Types of CAs You’ll Encounter
1. Public CAs (DigiCert, Let’s Encrypt, Sectigo)
Who uses them: Your website, public APIs, customer-facing services
Who trusts them: Everyone (browsers, phones, all OS)
Cost: $0 (Let's Encrypt) to $500+/year per cert
Auto-renewal: Yes (Let's Encrypt), varies (others)
Your job: Buy them, install them, renew them2. Internal CA (AD CS / Microsoft PKI)
Who uses them: Internal servers, devices, users, WiFi, VPN
Who trusts them: Only your domain-joined devices
Cost: Included with Windows Server
Auto-renewal: Auto-enrollment (when configured correctly)
Your job: Keep the CA healthy, manage templates, monitor enrollment3. Cloud CAs (AWS ACM, Azure Key Vault, GCP)
Who uses them: Cloud workloads, load balancers, APIs
Who trusts them: Public trust (for public certs) or limited
Cost: Usually free (bundled with cloud service)
Auto-renewal: Mostly automatic
Your job: Request them, attach to services, verify automation worksAD CS vs. CLM: Capability Coverage
Each tool excels in its domain — together they provide full lifecycle coverage
AD CS = Issuance Engine
Templates, enrollment, renewal, key generation
CLM = Visibility Layer
Inventory, alerts, deployment, ownership, compliance
The CA Hierarchy (Simplified)
┌─────────────────┐
│ Root CA │ ← Offline, locked in safe
│ (Trust anchor) │ Only used to sign subordinates
└────────┬────────┘
│
┌────────────┼────────────┐
│ │ │
┌────────▼───┐ ┌────▼─────┐ ┌──▼──────────┐
│ Issuing CA │ │Issuing CA│ │ Issuing CA │
│ (Servers) │ │ (Users) │ │ (Devices) │
└────────────┘ └──────────┘ └─────────────┘
│ │ │
Issues certs Issues certs Issues certs
to IIS, SQL, for email, for WiFi,
Exchange VPN login laptopsWhy this matters to you:
- If the Root CA certificate expires → EVERYTHING breaks (all issued certs become untrusted)
- If an Issuing CA goes down → New certificates can’t be issued (existing ones still work until expiry)
- If you lose the Root CA private key → Game over, rebuild from scratch
What You Need to Know About AD CS
Components you'll interact with:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CA Server (certsrv) - Issues certificates
Certificate Templates - Defines what types of certs can be issued
Auto-Enrollment (GPO) - Pushes certs to devices automatically
CRL/OCSP - Publishes revocation information
Web Enrollment - UI for manual cert requests
Commands you'll use:
━━━━━━━━━━━━━━━━━━━
certutil -pulse - Force auto-enrollment NOW
certutil -viewstore My - See machine's certificates
certutil -verify cert.cer - Validate a certificate
certutil -dump cert.cer - See all cert details
certlm.msc - Certificate store GUI (machine)
certmgr.msc - Certificate store GUI (user)What Breaks (And Why)
The Hit List: Certificate Failures by Frequency
Most common cert failures (ranked):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Certificate expired (50% of issues)
2. Certificate name mismatch (15% of issues)
3. Untrusted CA / missing chain (12% of issues)
4. Auto-enrollment failure (10% of issues)
5. Wrong certificate bound to service (8% of issues)
6. Private key issues (5% of issues)Failure 1: Certificate Expired
Scenario: Website certificate expires on Saturday
Impact: Browsers show "Your connection is not private"
Cause: Nobody tracked the expiry date
Fix: Install new certificate on the web server
Prevent: Monitor all cert expiry dates, alert at 60 daysFailure 2: Name Mismatch
Scenario: Certificate is for "server01.company.com"
but users access "portal.company.com"
Impact: "The certificate is not valid for the requested host"
Cause: Wrong certificate installed, or SAN entry missing
Fix: Get a cert with the correct names (SANs)
Prevent: Always verify SANs cover all access URLsFailure 3: Untrusted CA
Scenario: Internal CA cert not deployed to new server
Impact: "Certificate issued by untrusted authority"
Cause: Root/intermediate CA cert missing from trust store
Fix: Install the CA certificate chain
Prevent: Deploy CA certs via GPO, verify new server builds include themFailure 4: Auto-Enrollment Failure
Scenario: 200 laptops stop getting WiFi certs
Impact: Devices can't authenticate to corporate WiFi
Cause: Template permissions changed, or CA unreachable
Fix: Restore template perms + certutil -pulse on devices
Prevent: Monitor enrollment success rates, test template changesThe Certificate Store (Where Certs Live on Windows)
Certificate Stores on a Windows Machine:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Cert:\LocalMachine\My → Server's own certificates
Cert:\LocalMachine\Root → Trusted Root CAs
Cert:\LocalMachine\CA → Intermediate CAs
Cert:\CurrentUser\My → User's personal certificates
What should be WHERE:
┌────────────────────────┬──────────────────────────┐
│ Store │ What belongs here │
├────────────────────────┼──────────────────────────┤
│ LocalMachine\My │ IIS cert, machine auth │
│ LocalMachine\Root │ Your Root CA cert │
│ LocalMachine\CA │ Issuing CA certs │
│ CurrentUser\My │ User's email/VPN cert │
└────────────────────────┴──────────────────────────┘Quick Diagnostic Commands
# See all machine certificates
Get-ChildItem Cert:\LocalMachine\My |
Select-Object Subject, NotAfter, Issuer |
Sort-Object NotAfter
# Find expiring certificates (next 30 days)
$threshold = (Get-Date).AddDays(30)
Get-ChildItem Cert:\LocalMachine\My |
Where-Object {$_.NotAfter -lt $threshold -and $_.NotAfter -gt (Get-Date)} |
Select-Object Subject, NotAfter
# Check trust chain for a specific certificate
certutil -verify -urlfetch "C:\path\to\cert.cer"
# Force certificate enrollment
certutil -pulse
# Export a certificate
Export-Certificate -Cert "Cert:\LocalMachine\My\THUMBPRINT" -FilePath "C:\cert.cer"Daily Operations: What IT Teams Actually Do
Weekly Tasks
| Task | How | Time |
|---|---|---|
| Check for expiring certs | Script/CLM dashboard | 5 min |
| Verify auto-enrollment health | Check CA event logs | 10 min |
| Review new cert requests | CA admin console | 10 min |
Monthly Tasks
| Task | How | Time |
|---|---|---|
| Certificate inventory review | Export from CA + scan | 1 hour |
| CRL publication verification | certutil -CRL | 5 min |
| Template permission audit | certtmpl.msc review | 30 min |
| CA backup verification | Restore test | 1 hour |
Quarterly Tasks
| Task | How | Time |
|---|---|---|
| Root CA health check | Power on offline CA, verify | 2 hours |
| Disaster recovery test | CA restore drill | Half day |
| Certificate policy review | Documentation update | 2 hours |
| Algorithm compliance review | Inventory analysis | 1 hour |
The “Cheat Sheet” for Common Scenarios
Someone asks for a certificate
Questions to ask:
1. What's it for? (web server, client auth, code signing)
2. What names does it need? (FQDN, SANs)
3. Internal or external? (determines which CA)
4. How long should it be valid?
5. Who will own/renew it?A service shows certificate errors
Diagnostic steps:
1. Check expiry: openssl x509 -noout -dates -in cert.cer
2. Check names: openssl x509 -noout -text -in cert.cer | grep DNS
3. Check chain: certutil -verify -urlfetch cert.cer
4. Check binding: netsh http show sslcert (or IIS Manager)
5. Check private key: certutil -verifykeysAuto-enrollment isn’t working
Diagnostic steps:
1. Force enrollment: certutil -pulse
2. Check event log: Application log, source: AutoEnrollment
3. Check template: Does machine have Enroll permission?
4. Check CA: Is the CA online and responsive?
5. Check DNS: Can machine resolve CA hostname?
6. Check ports: Can machine reach CA on 135/dynamic RPC?What NOT to Worry About (As an IT Team)
Leave these to the security/PKI architects:
✗ RSA vs ECDSA algorithm selection
✗ Key ceremony procedures
✗ Certificate Policy (CP) document writing
✗ Cross-certification decisions
✗ OCSP responder tuning
✗ HSM management
✗ Crypto agility planning (PQC)
Focus on these (your actual job):
✓ Certs don't expire unexpectedly
✓ Auto-enrollment works
✓ Servers have the right certs
✓ New machines can get certs
✓ You know where every cert is
✓ Someone owns every certificate
✓ The CA is backed up and recoverableAbout QCecuring
QCecuring makes PKI operations manageable for IT teams. Our platform handles the complexity of certificate discovery, monitoring, and lifecycle management so you can focus on keeping services running — not debugging cryptographic infrastructure.
Tags: PKI, IT operations, certificate management, AD CS, enterprise PKI, practical PKI, certificate troubleshooting, CA hierarchy, Windows PKI, certificate basics, IT teams