Install Root Certification Authority Service in Server 2008 r2

Go to Server-Cert and open Server Manager; right-click Roles and choose Add Roles.

Click Next to skip the Welcome screen. On the Roles screen select the Active Directory Certificate Services and click Next.

Skip the introduction of AD CS. On the Role Services screen we have the option to install more than just the certificate service. For this demonstration I’m going to install the Certification Authority Web Enrollment too. This will give us a web page to request certificates, and it’s great, believe me. As soon as you click the Certification Authority Web Enrollment you will be asked to install some required prerequisites. And off course a web site to function needs a web server. Just click Add Required Roles Services and continue the wizard.

      

Because this is about installing Enterprise Root CA, just leave the defaults here and click Next.

Again leave the defaults here to install a Root CA.

We need to create a new private key, so click Next to continue.

For Enterprise Root CA I usually choose a length key of 4096 and leave the rest to default.

Give your Root CA a name. I aways change the name, because I really hate the default one.

Select a validity period. For Enterprise Root CA I usually type 30 years.

If you have a reason to change the default log and database location, do it using the Browse buttons. Now comes the IIS installation part, just go with the defaults and finish the wizard.

The installation is done. Go to Administrative Tools > Certification Authority to open the Management Console for the Certificate Services. From this console you can revoke certificates and create templates.

To see the root certificate just right-click the server name, choose Properties and hit the button View Certificate

Open a browser and type http://localhost/certsrv, and the Certificates Services Web Enrolment page should open. Using this web page clients can request certificates, if they have the proper permissions.