Installing Microsoft ADCS on Windows Server using SafeNet KSP
You must configure Microsoft ADCS to use the ProtectServer 3 HSM when you configure the Microsoft Certificate Authority (CA) user role.
Note
The SafeNet KSP must be configured before proceeding with the installation of Microsoft ADCS. For more information about configuring the SafeNet KSP, see Configuring the SafeNet KSP
To install Microsoft ADCS
-
Log on as an Enterprise Admin/Domain Admin with Administrative privileges.
-
Open the Server Manager under Configure this Local Sever and select Add Roles and Features.
-
The Add Roles wizard appears.
-
Select Next.
-
Select the Role-based or feature-based installation radio button and Next.
-
Select the Select a server from the server pool radio button and select your server from the Server Pool menu.
-
Select Next.
-
Select the Active Directory Certificate Services check box.
A window displays stating Add features that are required for Active Directory Certificate Services?.
-
To add a feature, select the Add Features button.
-
Select Next to continue.
-
On the Active Directory Certificate Services page, select Next to continue.
-
Select the Certification Authority check box from the Role services list and Next.
-
Select Install.
-
When the installation is complete, select Configure Active Directory Certificate Services on the destination server.
The ADCS Configuration wizard displays
-
Select the Notification tab of Server Manager, configure ADCS, and then Next.
-
Select the Certification Authority check box and Next.
-
Select the Enterprise CA radio button and Next.
-
Select the Root CA radio button and Next.
-
Setup the Private Key for the CA to generate and issue certificates to clients. If you would like to create a new private key, select the Create a new private key radio button and Next. If you would like to use an existing private key, proceed to step 24.
-
Open the Select a cryptographic provider: drop-down menu and select an algorithm using a SafeNet Key Storage Provider. Open the Key length: drop-down menu and select a key-length.
-
Select the Hash Algorithm for signing certificates issued by this Certificate Authority and key length settings for your installation.
-
Select the Allow administrator interaction when the private key is accessed by the CA check box and Next. Proceed to Step 27.
-
Select the Use existing private key check box. Setup the Private Key for CA to generate and issue certificates to clients. Select Use existing private key and Select an existing private key on this computer. Select Next to continue.
-
Select Change. Select the SafeNet Key Storage Provider algorithm that you have used to generate the private keys and clear the CA Common name, select Search.
-
Select the Existing Key and select Next.
-
Configure a common name to identify this Certificate Authority and select Next.
-
Proceed to set the Certificate Validity Period and select Next. Configure the Certificate database location. It records all the certificate requests, issued certificates, and revoked or expired certificates. Select Next.
-
Select Configure to configure the selected roles, role services, or features.
-
Select Close to exit the ADCS Configuration wizard after viewing the installation results.
A private key for the CA will be generated and stored on the HSM.
-
Open a command prompt and run
sc query certsvcto verify that service is running: -
Open a command prompt and run
certutil –verifykeysto verify the CA key:The result of the command shows the CA keys have successfully been verified.
