Install an enterprise root certification authority

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To install an enterprise root certification authority

1. Log on as a member of both the Enterprise Admins group and the root domain's Domain Admins group.

2. If any Windows 2000 enterprise certification authorities (CAs) currently exist or have ever existed in your enterprise, open Certificate Templates and, when prompted to install new certificate templates, click OK.

3. Open Add or Remove Programs in Control Panel.

4. Click Add/Remove Windows Components.

5. In the Windows Components Wizard, select the Certificate Services check box. A dialog box appears to inform you that the computer cannot be renamed and that the computer cannot be joined to or removed from a domain after Certificate Services is installed. Click Yes, and then click Next.

6. Click Enterprise root CA.

7. (Optional) Select the Use custom settings to generate the key pair and CA certificate check box, and then click Next to specify the following.

   To set this	Do this
   Cryptographic service provider (CSP)	In CSP, click the CSP that you want to use. The default is the Microsoft Strong Cryptographic Provider. Certificate Services does support third party CSPs, but you must refer to the CSP vendor's documentation for information about using their CSP with Certificate Services.
   Hash algorithm	In Hash algorithm, click the hash algorithm you want to use. The default is SHA-1.
   Use an existing key	Select the Use existing key check box, click Import, and then, in Open PFX File, type the file name and password of the public and private key pair. This is helpful if you are relocating or restoring a previously installed certification authority (CA). Note that, when using an existing key, a new certificate is generated. Important Be sure that you select an existing key that you know to be uncompromised and trustworthy. Using a key that may be compromised or untrusted could cause this CA and all its issued certificates to be insecure.
   Key length	In Key length, type or select a key length. The default key length using the Microsoft Strong Cryptographic Provider is 2048 bits. Default key lengths for other CSPs vary. In general, the longer the key length, the more secure the key is. Also, longer key lengths require more system resources for operations such as signing, encryption, and chain verification. For a root CA, you should use a key length of at least 2048 bits. This option is not available if you use existing keys.
   Allow this CSP to interact with the desktop	Select the Allow this CSP to interact with the desktop check box. Without this option, system services cannot interact with the desktop of the user who is currently logged on.
   Import	Click Import. This imports an existing key in the PKCS #12 PFX format.
   View certificate	Click View certificate. This allows you to view the certificate that you select or generate during installation.

   When you are done, click Next.

8. In Common name for this CA, type the common name of the certification authority.

9. In Validity period, specify the validity duration for the root CA and click Next.

10. Specify the storage locations of the certificate database, the certificate database log, and the shared folder and click Next.

11. If Internet Information Services (IIS) is running, you will see a request to stop the service before proceeding with the installation and click OK.

12. If prompted, type the path to the Certificate Services installation files.

Notes

• The preliminary information that is supplied during setup, such as the name of the certification authority, cannot be changed after the CA setup is complete.

• Before installing a certification authority, you should configure the computer's domain settings first, such as joining a domain or promoting a server to a domain controller. These settings cannot be changed once the certification authority is installed.

• If Active Server Pages are not enabled through Internet Information Services, you will be prompted to activate them. The Web interface for the certification authority requires running Active Server Pages.

• The enterprise root CA selection requires that the host computer be a member of a domain and that it use the Active Directory directory service. The administrator who is installing an enterprise CA must have Write permission to Active Directory.

• If you have Write permission to Active Directory, then specifying the shared folder is optional, and is not typically done for enterprise certification authorities.

• The validity duration you choose for the CA will determine when the CA "expires." For information about renewing CAs, see Related Topics.

• If you installed the enterprise certification authority as an Enterprise Admin or delegated user, then you must use the Enterprise Admin or delegated user account when you uninstall the enterprise certification authority.

• To open Add/Remove Windows Components, click Start, click Control Panel, double-click Add or Remove programs, and then click Add/Remove Windows Components.

• Once the certification authority is installed, add certificate templates to the certification authority and configure the certification authority to allow subjects to request a certificate that is based on a template. For more information, see Related Topics.

• For more information on any installation settings, see Related Topics.

Information about functional differences

• Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

See Also

Concepts

Enterprise certification authorities
Install an enterprise subordinate certification authority
Renewing a certification authority
Add a certificate template to a certification authority
Install new templates and upgrade existing templates