Assign a static IP address for this host.

Give the host an appropriate computer name (<csserver>).

Add the host member of the domain (yourcompany.com) using an account that belongs to the Domain/Enterprise Admin group.

Open the Server Manager.

Click Add roles and features.

Click Next.

Select Role-based or feature-based installation and click Next.

Select Select a server from the server pool, select this server, and then click Next.

Select Active Directory Certificate Services.

When prompted to add required features, click Add Features.

Proceed until reaching the Role Services page.

Select Certification Authority and Certification Authority Web Enrollment.

In the appearing popup panel, click Add Features to add IIS and its corresponding features.

Proceed until the Confirmation page and click Install.

When the installation completes, click Close.

Click the new task shown in the Server Manager notifications: Configure Active Directory Certificate Services on the destination server.

In the shown credentials panel, click Change.

Enter an account that belongs to the Domain/Enterprise Admin group, click OK, and then click Next.

Select role services to configure Certification Authority and Certification Authority Web Enrollment, and then click Next.

Select Enterprise CA, and click Next.

Select Root CA, and click Next.

Select Create a new private key and click Next.

Set the Cryptography provider to RSA#Microsoft Software Key Storage Provider.

Set the Key Length to 4096 bits.

Set the hash algorithm to SHA256 and click Next.

Enter a unique name for the CA such as <MSCA-Proxy> and then click Next.

Set the validity period 25 years.

Configure the location for the certificate database and certificate database logs.

Click Next, then click Configure, and then click Close.

If not done yet, create the service account (<ces-service>) for Certificate Enrollment Services and the service account (<servlet-service>) for the Tomcat servlet on AD Domain Services Server
Use the single service account if performing this installation with a single service account on a single host.

Open the Local Users and Group manager (lusrmgr.msc).

Navigate to Groups.

Right-click the IIS_IUSRS group and select Properties.

Click Add and enter the object name <YOURCOMPANY\ces-service>.

Click OK and enter an account that belongs to the Domain/Enterprise Admin group, then click OK.

Open the Command Prompt with Admin permissions.

Set the service principal name for the service account by running the following commands as admin and ensure to replace the server <FQDN> and account names with your own configuration.

If using a single service account and performing this installation on a single host (the csserver host), ensure to only run the setspn command once.

Open the Server Manager.

Click Add roles and features and click Next.

Select Role-based or feature-based installation and click Next.

Select Select a server from the server pool, select this server and click Next.

Expand the Active Directory Certificate Services, select Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service and then click Next.

Proceed until the Confirmation page and click Install.

Reboot the server after the roles have been installed.

Open the Certificate Authority Manager (certsrv.msc).

Expand the selection for your CA.

Right-click Certificate Templates and click Manage.

Ignore the create the object identifier list warning and click OK, and then click Refresh.

Right-click the Computer template, select Duplicate Template and specify the following:

1. Under Compatibility Settings, specify Certification Authority=Windows Server 2003 and Certificate recipient=Windows XP/Server 2003.

2. Click the General tab, and change the Template display name to Computer_Auto_Enrollment.

3. Click the Security tab, and give "Domain Computers" permissions to Enroll and Autoenroll.

4. Select the Subject Name tab, and change the Subject name format to DNS Name.

5. Select DNS Name in the subject alternative name.

6. Under the Request Handling tab, clear Allow private key to be exported.

7. Click OK to go back to the template list.

Right-click the User template and select Duplicate Template and specify the following:

1. Under Compatibility Settings, specify Certification Authority=Windows Server 2003 and Certificate recipient=Windows XP/Server 2003.

2. Click the General tab, and change the Template display name to User_Auto_Enrollment.
   If the requirement is to Publish the User certificate in Active Directory and Credential Roaming is enabled, ensure to s elect both Publish certificate in Active Directory and Do not automatically re-enroll if a duplicate certificate exists in Active Directory.

3. Select the Security tab, and give "Domain Users" permissions to Enroll and Autoenroll.

4. Select the Subject Name tab, and change the Subject name format to Common name.

5. Clear Include email name in subject name and clear Email name in the subject alternative name.

6. Select User principal name (UPN).

7. Under the Request Handling tab, clear Allow private key to be exported.

8. Click OK to go back to the template list and then c lose the Certificate Templates Console window.

Return to the Certificate Authority manager, r ight-click Certificate Templates, specify the following and then click OK:

1. Select New > Certificate Template to Issue.

2. Select Computer_Auto_Enrollment and User_Auto_Enrollment.

Delete all templates in the Certificate Templates section except for the 2 templates Computer_Auto_Enrollment and User_Auto_Enrollment.

To obtain the Microsoft certificate template OIDs:

1. Open Powershell and run the following command to get the Certificate Template OID:
   

   Certutil -catemplates -v | select-string displayname,msPKI-Cert-Template-OID

2. Ensure to note the OIDs for the Computer_Auto_Enrollment and User_Auto_Enrollment templates since you will use these values late r.

Click the new task shown in the Server Manager notifications: Configure Active Directory Certificate Services on the destination server.

In the credentials panel shown, click Change.

Enter an account that belongs to the Domain/Enterprise Admin group, click OK and then click Next.

Select Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service and click Next.

Select the CA Name.

Click Select and select the Microsoft CA that will be issuing the certificates using certificate enrollment web service, click OK and then click Next.

For CES authentication type, select Windows Integrated Authentication and then click Next.

For CES service account, select Specify service account and then click Select.

Specify the service account <ces-service> and credentials and ensure to use the single service account created if using a single service account.

Click OK and then click Next.

For CEP authentication type, select Windows Integrated Authentication and then click Next.

For Certificate authentication, select Choose and assign a certificate for SSL later and click Next.

Review the confirmation page and click Configure.

When the installation completes, click Close.

Open Microsoft Management Console (mmc.exe).

Add the Certificates snap-in.

Choose Computer account, select Local Computer and then click OK.

Navigate to Certificate (Local Computer) and select Personal.

Right-click and select All Tasks > Request New Certificate and click Next.

Select Active Directory Enrollment Policy and click Next.

Select Computer and Enroll, click Next, and then click Finish.