Generate/Sign certificates with the AD trusted root certificate

active-directorycertificatecertificate-authority

I know that when an Active Directory domain is created:

  • it creates its own root certificate
  • and that root certificate is automatically pushed into machines when they are joined to the domain

You can find this domain certificate in your Trusted Root Certification Authorities store:

enter image description here

e.g. our domain's self-signed cert is valid for 50 years.

Can this cert sign others?

The question is: Can this trusted root certificate be used as a trusted root certificate?

I want to have other certificates that are used by other services (e.g. SQL Server Use Encryption for Data certificate) that is automatically trusted by all machines on the domain.

  • Is there any way to sign a certificate with the AD root certificate?
  • Is it possible to have the AD controller generate trusted certificates?

Certificate Services

I know that Microsoft has a product called Active Directory Certificate Services.

  • I believe this service creates it's own root certificate (independent of the Active Directory Domain root certificate) that,
  • I believe that this root certificate is not signed by the domain's root certificate
  • and I believe that you have to push this certificate yourself out to machines on the domain (e.g. using a login script, a group policy, or manually).

Obviously that's not what I'm asking about. I'm asking about using the domain's trusted root certificate to sign other certificates so that they are trusted automatically.

Best Answer

it creates it's own root certificate

no, domain controllers don't generate root certificates.

and that root certificate is automatically pushed into machines when they are joined to the domain

no, domain controllers do not push certificates into domain machines.

Certification Authority (CA) does this. Based on your description and provided image, I can say that you already have an instance of ADCS or had it in the past. Probably, it was decommissioned, but not cleaned properly from Active Directory.

and i believe that you have to push this certificate yourself out to machines on the domain (e.g. using a login script, a group policy, or manually).

again, no. When installing a root CA in Active Directory, it automatically pushes its root certificate to Active Directory and this certificate is automatically propagated to domain members. No logon scripts, no GPO, it is done via Active Directory.

The question is: Can this trusted root certificate be used as a trusted root certificate?

technically, yes if CA server is still alive. If it is dead, you have to cleanup AD from retired CA server by removing objects from AD: How to Decommission a Windows Enterprise Certification Authority and How to Remove All Related Objects. You need to perform only steps 6 and 7.

How to check if CA is alive or dead? You can try to run pkiview.msc console (requires ADCS RSAT) and check if console can contact CA server. Alternatively, you can run certsrv.msc console and use Retarget Certification Authority to switch to registered CA server. If both options fail, then most likely, the CA is dead and you will go through CA decommission process.

What you really need is to have a certification authority. You will need to set up an instance of ADCS server on dedicated machine (never install ADCS on domain controllers) and use it to issue certificates to domain members for required purposes. Though, I would go with proper planning first in order to have a reliable and scalable enterprise PKI solution (which is beyond the current thread's scope).

Related Topic