SSL Certificates – Can Standalone CA and Subordinate Enterprise CA Issue Valid Intranet Certs?

active-directorycertificate-authoritydomain-controllerssl-certificate

The question is purely about whether this config is capable of issuing valid intranet SSL certs (i.e. SSL certs for internally facing sites), and not any other implications or concerns.

(The focus of the question isn't security, availability, continuity, disaster recovery or any other implications or concerns other than the ability to issue valid SSL certs.)

Context: inherited an AD setup where the primary DC has a CS/CA role and no templates – which means the CA is "standalone", not "enterprise", confirmed via certutil -getreg ca\catype:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<masked>AD01-CA\CAType:

  CAType REG_DWORD = 3
    ENUM_STANDALONE_ROOTCA -- 3
CertUtil: -getreg command completed successfully.

There is also a "subordinate" CA running on a secondary DC that is "enterprise" (although its "templates" feature isn't working: "no templates found" errors when using Web Enrollment on it).

The question

Is this configuration ("standalone" root CA + "enterprise" subordinate CA) capable of issuing valid SSL certs for intranet sites like vCenter, SolarWinds, etc.?

Reason I ask:

Having a lot of trouble figuring out how to get a "trusted" SSL setup for internally facing (intranet) sites and could use any help I can get:

Figure this may have something to do with how CAs and DCs are currently set up.

If this is not OK and I need to switch to an "enterprise" CA, what's the easiest way to do so?

P.S. I am OK with it not being configured quite to specs with offline/online CAs and CAs not running on DCs – for now the only goal is to be able to issue good certificates to internally facing sites and apps.

Thanks!

Best Answer

It is NOT OK to run any certificate services on domain controllers. They must be installed on member servers only.

There are two reasons for that:

  1. You won't be able to replace your domain controller if certificate services are installed on DC. As per best practices, DCs are replaced by adding new DC into network and then demoting and decommissioning old DC. You cannot demote DC with CA role. You will have to uninstall CA role first before you can demote DC.
  2. Microsoft Certification Authority is a forest-wide resource. And in multi-domain environments, admins in one domain may affect other domains they don't have permissions in.
Related Topic