To install a stand-alone subordinate certification authority

1. Log on to the system as an Administrator, or if you have the Active Directory directory service, log on to the system as a Domain Administrator.
2. Open Add or Remove Programs in Control Panel.
3. Click Add/Remove Windows Components.
4. In the Windows Components Wizard, select the Certificate Services check box. A dialog box appears to inform you that the computer cannot be renamed and that the computer cannot be joined to or removed from a domain after Certificate Services is installed. Click Yes, and then click Next.
5. Click Stand-alone subordinate CA.
6. (Optional) Select the Use custom settings to generate the key pair and CA certificate check box, and then click Next to specify the following.

   To set this	Do this
   Cryptographic service provider (CSP)	In CSP, click the CSP that you want to use. The default is the Microsoft Strong Cryptographic Provider. Certificate Services does support third party CSPs, but you must refer to the CSP vendor's documentation for information about using their CSP with Certificate Services.
   Hash algorithm	In Hash algorithm, click the hash algorithm you want to use. The default is SHA-1.
   Use an existing key	Select the Use existing key check box, click Import, and then, in Open PFX File, type the file name and password of the public and private key pair. This is helpful if you are relocating or restoring a previously installed certification authority (CA). Note that, when using an existing key, a new certificate is generated. Important Be sure that you select an existing key that you know to be uncompromised and trustworthy. Using a key that may be compromised or untrusted could cause this CA and all its issued certificates to be insecure.
   Key length	In Key length, type or select a key length. The default key length using the Microsoft Strong Cryptographic Provider is 2048 bits. Default key lengths for other CSPs vary. In general, the longer the key length, the more secure the key is. Also, longer key lengths require more system resources for operations such as signing, encryption, and chain verification. For a root CA, you should use a key length of at least 2048 bits. This option is not available if you use existing keys.
   Allow this CSP to interact with the desktop	Select the Allow this CSP to interact with the desktop check box. Without this option, system services cannot interact with the desktop of the user who is currently logged on.
   Import	Click Import. This imports an existing key in the PKCS #12 PFX format.
   View certificate	Click View certificate. This allows you to view the certificate that you select or generate during installation.

   When you are done, click Next.
7. Type in the common name (CN) and distinguished name suffix of the CA. None of this information can be changed after the CA setup is complete. Click Next.
8. Specify the storage locations of the certificate database, the certificate database log, and the shared folder. Click Next.
9. Obtain the certificate for the subordinate CA. For instructions on how to do this, see Notes.
10. If Internet Information Services is running, the system will request that you stop the service before proceeding with the installation. Click OK.
11. If prompted, type the path to the Certificate Services installation files.

Notes

• If Active Server Pages (ASP) are not enabled through Internet Information Services, you will be prompted to activate them. The Web interface for the certification authority requires running Active Server Pages.
• To obtain the certificate for a subordinate CA, you must submit a certificate request to a parent CA. The procedure for doing so differs depending on whether the parent CA is available online.
  • If a parent CA is available online:
    1. Click Send the request directly to a CA already on the network.
    2. In Computer Name, type the name of the computer on which the parent CA is installed.
    3. In Parent CA, click the name of the parent CA.
  • If a parent CA is not available online:
    1. Click Save the request to a file.
    2. In Request file, type the path and file name of the file that will store the request.
    3. Obtain this subordinate CA's certificate from the parent CA.

       The procedure for doing this will be unique to the parent CA. At a minimum, the parent CA should provide a file containing the subordinate CA's newly-issued certificate and, preferably, its full certification path. For the procedure to submit a certificate request using a file to a Microsoft CA, see Related Topics.

       If you get a subordinate CA certificate that does not include the full certification path, the new subordinate CA you are installing must be able to build a valid CA chain when it starts. Because of this, you must install the parent CA's certificate in the Intermediate Certification Authorities certificate store of the computer (if the parent CA is not a root CA), as well as the certificates of any other intermediate CA in the chain, and you must install the certificate of the root CA in the chain into the Trusted Root Certification Authorities store. These certificates should be installed in the certificate store before you install the CA certificate on the subordinate CA you have just set up.

    4. Open Certification Authority.
    5. In the console tree, click the name of the CA.

       Where?

       • Certification Authority (Computer)
       • CA name
    6. On the Action menu, point to All Tasks, and then click Install CA Certificate.
    7. Locate the certificate file received from the parent certification authority, click this file, and then click Open.
    8. If the root CA is untrusted, click OK to trust the root CA's certificate.
    9. Once the certificate is installed, start the Certificate Services service.
• If Active Directory is available and you have Write permission to Active Directory, then specifying the shared folder is optional.
• XOX
• XOX

Related Topics