how to install certificate authority on windows server 2012

Step 1:

You need to have this role installed to have a Certificate Authority , It can be DC or Exchange itself
I have done this in the Exchange Server itself (No Harm)

Open Server Manager – Manage – Add Roles and Features

Step 2:

Choose : Active Directory Certificate Services

Choose Next

And Choose : Certification Authority Web Enrollment

Choose :

Certification Authority

Certification Authority Web Enrollment

Choose Install

Choose Close

Step 3:

To Configure Active Directory Certificate Services

Choose the Exclamation Mark on the Flag

Choose Next

Choose

Certificate Authority

Certification Authority Web Enrollment

Choose Enterprise

Step 4:
Choose Root CA

Step 5:
Create a new Private key

Step 6:
Have this Default with 2048 key Character length

Updated === Its recommended to use SHA256 as SHA1 is retiring.

To Upgrade your existing internal CA –

certutil -setreg ca\csp\CNGHashAlgorithm SHA256

Step 7:
Click Next

Step 8:
By Default Certificate is valid for 5 years , Don’t make any changes on it , Click next

Step 9:

Choose Configure

Installing and Configuring is Done.

Let us see how to Request a Create a Simple Cert from Internal Certificate Authority

Step 10:
Now if you Open IIS manager , you will see “CertSrv” a Virtual Directory Created ,

Use the right side column “Browse *.443(https)

Note :

If you don’t see a “Browse *.443(https) , It means binding is not there. As my Example as Exchange 2013 , Exchange added the binding.

To add binding – Right Click on Default Web Site – Click on Edit Bindings

Click on ADD

HTTPS – 443 – Choose the CA Cert

Now you can see 443 in your website.

Step 11:
You would see a page like this , Choose Request a Certificate

Step 12:
Click on Advanced Certificate Request

Step 13:
Choose the Second one
Submit a certificate request by using a base-64-Encoded CMC

Step 14:
Now Copy the Note pad – You have to generate a Certificate Request from the application. For example how we are doing in exchange server

https://www.azure365pro.com/how-to-create-an-ssl-certificate-request-for-exchange-server-2013/

Or you can use https://www.digicert.com/util/
Choose Template : WebServer

Step 15:
Choose “Base 64 encoded”

Step 16:
Save the Certificate

82 COMMENTS

Jeff January 14, 2013 At 7:10 am

Great job. thank you!

ahmad ghazi January 31, 2013 At 2:17 pm

its good Very tnx :X

- Satheshwaran Manoharan January 31, 2013 At 3:37 pm
  
  your welcome Ahmad Ghazi !
  
Ajay Paul February 11, 2013 At 4:32 pm

Hi, many thanks for the write up.

will this cert enable internal outlook users to connect to internal exchange server 2013?

thanks in advance

Ajay Paul

- Satheshwaran Manoharan February 11, 2013 At 4:36 pm
  
  Thank Ajay.
  
  the answer is Yes.
  
  It should work with Internal Outlook without any problems !!
  
Mahmoud February 14, 2013 At 6:56 pm

Thanks Satheshwaran,
i have 2012 dc and exchange 2007 sp3 can i use this certificate with it and how can i import it to exchange.

- Satheshwaran Manoharan February 15, 2013 At 3:25 am
  
  It should work
  
  Use think link for the Commands you can use for Exchange 2007.
  
  http://luka.manojlovic.net/2008/01/12/new-certificate-in-exchange-2007-step-by-step/
  
Steve March 21, 2013 At 4:06 pm

Thanks for the guide! I’m getting the following message when trying to request a certificate by using a base-64-encoded CMC: “No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing Active Directory.” This is a brand new Windows Server 2012 installation and I followed your guide from start to finish. Any ideas?

Steve

- Satheshwaran Manoharan March 22, 2013 At 2:23 pm
  
  Make sure you are a member. Of enterprise admins
  
  - Steve March 26, 2013 At 7:53 pm
    
    I already am. Any other ideas?
    
    - Satheshwaran Manoharan March 27, 2013 At 5:28 am
      
      might be some bug , Create a New Admin . Give all access and login with that admin and try. also
      
      check the below forum – Similar one –
      http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/5be22856-0598-46c1-b334-1ec4a81100d2/
      
Steve March 28, 2013 At 4:12 pm

Thanks, I’m not sure what happened but I uninstalled ADCS and reinstalled it and everything is working properly now.

- Satheshwaran Manoharan September 27, 2015 At 5:06 am
  
  Happy for you
  
Rajnish May 9, 2013 At 8:20 am

Great post…thanks..this helped me lot

- Satheshwaran Manoharan May 15, 2013 At 2:22 am
  
  Thank you Rajnish
  
Jake May 10, 2013 At 5:48 pm

Hi Rajnish.

Are we missing a step or two?

When IIS is installed HTTPS is not enabled. In Step 10 the option to browse “Use the right side column “Browse *.443(https)” is not available.

Step 14 requires clarification – Now Copy the Note pad – We need an explanation of how the data in the Note pad coming from.

Please review and clarify

- Satheshwaran Manoharan May 15, 2013 At 2:19 am
  
  Hi ,
  
  Right Click and Browse , you should get to that page. if your installation is fine. with a Cert Error,
  
  - Ken June 27, 2013 At 12:31 am
    
    As the others have mentioned, While in IIS Manager, only Browse *.80 (http) is available to select. Browse *.443 (https) is not seen, nor are any others as shown in your description.
    
    Any Thoughts?
    
- afiq May 28, 2013 At 9:26 am
  
  i had the same problem. i can see http only
  
  - Anonymous October 27, 2013 At 6:55 pm
    
    i have it also
    
- Abdel November 8, 2013 At 10:31 am
  
  Same, no HTTPS !!!
  
colin gardly May 13, 2013 At 8:59 pm

no https. you have left out some important parts !!!!!!!!!!!

- Satheshwaran Manoharan May 15, 2013 At 2:14 am
  
  It does work with HTTPS . Can you be some more elaborate ?
  
Vino May 15, 2013 At 5:35 am

Is it possible to migrate 2008 CA server to other 2012 CA server..

- Satheshwaran Manoharan May 15, 2013 At 5:38 am
  
  Yes its possible .
  
  This should help you.
  
  http://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx
  
Bas May 15, 2013 At 7:57 am

OK – I’m at Step 14 – where does the NOTEPAD info come from !!! ?

I’m TESTING Exchange so don’t have a proper certificate
Will this work with a self-signed Certificate ?

(there is little or no information about using Self-Signed Certs with Exchange – I appreciate I’ll need one eventually if and when this gets into production)

- Satheshwaran Manoharan June 5, 2013 At 8:14 am
  
  You have to open the certificate request file , using notepad
  
  - AYB January 8, 2015 At 11:28 am
    
    Where to find this certificate request file to open?
    
    - Satheshwaran Manoharan January 17, 2015 At 4:05 am
      
      Wherever you saved it in the first place from your ExchangeServer/Application server from wherever you requested and Saved it.
      
afiq May 28, 2013 At 9:11 am

I dont have web server in certificate template.
why?
someone help me

- Satheshwaran Manoharan June 5, 2013 At 8:38 am
  
  I guess your missing some steps
  
David W Davis May 30, 2013 At 12:37 am

Great information, but request the following information:

In step 10 am I right clicking each port and copying information from each port, then copying into notepad, then pasting the information from notepad in step 14.
You have done a great job with your post and I am probably being naïve, but clarification would be appreciated.

- Satheshwaran Manoharan June 5, 2013 At 8:39 am
  
  Open the Certificate Request file using nOtepad. and paste it
  
- Satheshwaran Manoharan June 5, 2013 At 8:48 am
  
  Content Updated , I guess it should be clear now, Sorry for the confusion
  
Anonymous June 27, 2013 At 11:14 pm

good job mate weldone

- Satheshwaran Manoharan July 1, 2013 At 2:06 am
  
  Thank you .!
  
- Satheshwaran Manoharan July 16, 2013 At 1:08 am
  
  Thank you
  
Fran August 28, 2013 At 11:39 pm

And Where can I Find the Certificate Request file? Which is the location of the file?

- Satheshwaran Manoharan September 1, 2013 At 9:49 am
  
  When you Create a Cert Req – It the location you browse . and SAVE Fran .
  
Abdel November 8, 2013 At 10:36 am

As the others have mentioned, While in IIS Manager, only Browse *.80 (http) is available to select. Browse *.443 (https) is not seen, nor are any others as shown in your description.

Any Thoughts?

Carlos Santos May 14, 2014 At 1:42 pm

Hi,

It is possible to deploying a Windows Server 2012 R2 Certificate Authority in a windows server 2003 domain.

Thanks,

Carlos Santos

- Satheshwaran Manoharan June 3, 2014 At 6:49 am
  
  Yes it should work .
  
parimal May 15, 2014 At 12:37 pm

Hey,

In Step 3:Setup type->Specify the setup typeof the CA->the 1st option “Enterpirse CA” is greyed out for me.What should i do to enable it.Please suggest
thank you

nandakumar May 27, 2014 At 11:08 am

Great post…thanku ..this post helped me lot

BigHamp July 28, 2014 At 6:11 pm

DID EXATCTLY WHAT YOU INSTRCTRUCTED AND IT DID NOT WORK FOR ME! I am having the same issue at step 10 that others have been telling you about. You have assumed that when we get there that “Browse: 443 (https)” will be to on the right, and my friend, for some of us including myself, it “DOES NOT APPEAR”. And since it does not appear, when we get to step 14, the screen for the certificate text is blank. THEREFORE, YOUR INSTRUCTIONS FOR US WHO DO NOT SEE “443”, YOUR INSTRUCTIONS ARE NOT CORRECT! Please make note of this and adjust your post!

- Satheshwaran Manoharan July 30, 2014 At 9:30 am
  
  Updated the Blog .If you are installing this on a Non Exchange machine . You got to add bindings to see 443. Check now
  
  - pinkpineapple.co.jp October 16, 2016 At 2:55 am
    
    DÃ©jÃ , rien que le ton condescendant de certains… Petits bourgeois que tout Ã§a. Il faut de l’excÃ¨s en toutes choses, quitte Ã revenir parfois en arriÃ¨re. Vous nous proposez la mesure en toutes choses, quitte Ã ne pas bouger d’un pouce.Petits bourgeois que tout Ã§a.
    
Eyal Estrin August 5, 2014 At 4:43 pm

Check out my Windows 2012 R2 Certification Authority installation guide
http://security-24-7.com/windows-2012-r2-certification-authority-installation-guide/

Addis Abebayehu October 1, 2014 At 6:44 am

Where can I Find the Certificate Request file? I don’t see where you saved it? Can I get help on this please. Thanks!

- Satheshwaran Manoharan October 12, 2014 At 10:53 am
  
  Please save wherever you want.
  
Ahmed October 10, 2014 At 7:02 pm

when I go to certsrv I get no network, what should I do here?

Gnana Kumar January 20, 2015 At 7:09 am

Thank you so much for this Article and Very informative…All the best!!

- Satheshwaran Manoharan March 8, 2015 At 12:43 pm
  
  Thank you for your Comments
  
Mathias Ikiebe February 18, 2015 At 1:34 pm

How do I generate the Certificate before downloading it? where do they get the IP address used to log in to the url came from. when I on the web browser, it will not take it.eg 10.20.34.2/cert/svr.

Mike May 28, 2015 At 5:17 pm

I do not have a Default Website in the list, thus there is no CertSrv. What could I do to remedy this? I know how to create Sites but the directories… I don’t know where they should point to.

- Satheshwaran Manoharan June 7, 2015 At 4:46 am
  
  re-install.. the CA.. I guess you missed something.
  
- appadala August 8, 2015 At 12:05 am
  
  make sure “Web Enrollment” Roles are installed.
  if it is already checked then run the following command in admin mode.
  certutil -vroot
  
samsung June 12, 2015 At 6:26 am

how to migrate CA from windows 2003 DC to windows 2012 DC

appadala August 7, 2015 At 11:24 pm

please check the comments of the below URL
https://redmondmag.com/articles/2015/06/01/ad-certificate-services.aspx

munira August 19, 2015 At 11:06 am

Hi, many thanks for the write up.

will this cert enable external outlook users to connect to exchange server 2013?

thanks in advance

- Satheshwaran Manoharan August 20, 2015 At 4:33 am
  
  No. Its just for internal users. Its higly recommended to use a External cert for both. Internal and External
  
munira August 19, 2015 At 11:08 am

hi
will this cert enable external outlook users to connect to exchange server 2013?
thanks

shivendra Mishra August 25, 2015 At 6:22 pm

Hi Satheshwaran,

Could you please let me know whether can we install the CA in window 7 Machine?

- Satheshwaran Manoharan August 27, 2015 At 5:45 am
  
  I don’t think so.
  
Tamas September 16, 2015 At 10:27 am

Hello,

Thanks for this guide.

I’m almost done with it but at Certification template i cannot choose “Web server”. There is only User and Basic template. Why did I wrong?

Thank you!

Balaji September 21, 2015 At 12:50 pm

Hi Satish,

I am in the Step 14, I could not able to proceed after Step 13, could you please let me know the location from where I can copy the text and paste it in the request box. I searched in Certserv folder and in certrqxt, but not able to see the requested file contents.

Could you please help me out. Thanks..

- Satheshwaran Manoharan September 27, 2015 At 5:08 am
  
  I have added some explanation to help you better
  
Jeremy September 27, 2015 At 12:47 am

When I get to step 14 I am not getting the option to select web server. I am only getting a user option. Is there any way to correct this?

- Satheshwaran Manoharan September 27, 2015 At 5:09 am
  
  you can search for publishing templates
  
julien November 23, 2015 At 11:24 pm

Thank you so much,
if i create the CA server , can i assign outlook anywhere, auto discover with this server ?
after can i turn it off ? turn it on only when i need it ?

thank you

- Satheshwaran Manoharan November 29, 2015 At 11:04 am
  
  No Julien. I prefer you to buy a third part Certificate.. Unless there is a specific Need of using INternal CA.
  
Julien November 23, 2015 At 11:59 pm

i am missing WEB server certificate template .
any suggestions how to create a compatible on for exchange 2013 ?

John January 22, 2016 At 5:51 am

Hello,

I’ve seen internal CA servers more often nowadays. I’m not too familiar with its benefits for a business or company. The only certs I ever had to deal with was from 3rd party like GeoTrusts. So the question is, what are the benefits of having an internal CA server in the environment if it’s usually recommended to have external certs for both internal (Outlook) and external (OWA) users of Exchange? What other benefits will an internal CA server provide? Why are reasons why it would be beneficial for a business to setup one up? Please advise as I would like to get this going for our business if there are good benefits.

videntes tarotistas March 18, 2016 At 6:27 am

Very good article. I absolutely appreciate this site.
Keep it up!

Edwardson May 25, 2016 At 4:39 am

Thanks for the guide. I’m trying to create a User Certificate and i get the error below. What am i missing?

Your request failed. An error occurred while the server was processing your request.

Contact your administrator for further assistance.

Request Mode:
newreq NN – New Request (keygen)
Disposition:
(never set)
Disposition message:
(none)
Result:
Invalid pointer 0x80004003 (-2147467261 E_POINTER)
COM Error Info:
CCertRequest::Submit: Invalid pointer 0x80004003 (-2147467261 E_POINTER)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
No suggestions.

- laiskfons July 19, 2016 At 11:46 am
  
  Hello
  Please use Internet Explorer, I got same error, when using Chrome for Personal Certificate request.
  BR
  
  - James August 1, 2016 At 2:18 am
    
    I was also seeing the invalid pointer error when using Chrome. The process worked as expected when I tried in IE.
    
  - Rob July 25, 2019 At 6:52 pm
    
    I also received this exact error when using Chrome. Switched to IE and was successful.
    
w88 June 8, 2016 At 11:33 am

Thanks for some other informative blog. Where else may just I am getting that type of info written in such a perfect way?
I’ve a undertaking that I’m simply now running on, and I have been on the
glance out for such information.

Sohail September 17, 2017 At 6:38 am

I am getting below error when installing second CA server with SHA256 within the same forest

certification authority web enrollment network name is no longer available 0x80070040 (win32:64 ERROR_NETNAME_DELETED)

Can anyone help on the same

Chad Fisette August 21, 2020 At 3:34 pm

im getting this

our request failed. An error occurred while the server was processing your request.

Contact your administrator for further assistance.

Request Mode:
newreq NN – New Request (keygen)
Disposition:
(never set)
Disposition message:
(none)
Result:
Invalid pointer 0x80004003 (-2147467261 E_POINTER)
COM Error Info:
CCertRequest::Submit: Invalid pointer 0x80004003 (-2147467261 E_POINTER)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
No suggestions.

MEXICAN February 19, 2021 At 7:08 am

PERVERSO, GRAN TRABAJO AMIGO !!!
SALUDOS DESDE MEXICO !!!
GRACIAS POR TU APORTE !!!!