Active Directory Certificate Services

[Disease]

Has anyone done this in their network, I want to get rid of annoying HTTPS warning for internal servers, any points of note or pitfalls?

 

Many Thanks

[3s-gtech]

Yup. I've had a CA here for years, but only a couple of years ago did I shift our internal sites to https and cert them up.

 

If you're more skilled than I am, you can do it with Let's Encrypt and make things much easier. I only use that for our external services though.

 

This is the instruction set I have: https://lalmohan.co.nz/2020/02/10/create-and-install-a-san-certificate-subject-alternative-name-in-windows-without-third-party-tools/

 

It looks complex, but a numbnuts like me got it working.

 

Quote

 

The first step is to create a CSR.
Open the MMC console and add the Certificate snap-in to it as Local Computer. Right Click Personal node on the left and Select All Tasks –> Advanced Operations –> Create Custom Request

Choose Proceed without enrollment policy and Click Next. Choose No Template Legacy Key for compatibility reasons. Use PKCS#10
Click Next and click Properties

Give a friendly name for the certificate and a description. Ensure that you hit Apply as soon as you are done with the tab.
 
Click on Subject tab and add all the hostnames under “Alternative Name“
Under Subject Name, enter the Common Name (CN), Organizational Unit (OU), Organization (O), State (S) and Country (C) values. Click Apply
Subject name: CN – internalname.domain
Alternative name: DNS – otherinternalname.domain
 

Under the Extensions tab, expand Extended Key Usage (application policies) and select Server Authentication and Client Authentication
Click Apply
 
Under the Private Key tab, set the Key size to 4096 under Key options
Tick Make Private Key exportable
Select Exchange as the Key type
Click Apply. Click OK
 
Select a location to save the file. Choose the file format as Base 64
Click Finish

Send the Certificate Request
Now navigate to the URL of the internal Certificate Authority (CA) server. Replace your CA server name for the <certauthority> value.
https://ca-server/certsrv
Click the Request a Certificate link.
Click the Advanced certificate request link.
Click Submit a certificate.
Paste the contents of your CSR file into the Saved Request text box. (Open the CSR file (with a .req extension) in Notepad and copy the contents without any leading or trailing spaces.)
For the Certificate Template drop-down list, select Web Server.
Click Submit.
You get the below once you click submit.
 
Issue the Certificate
  
Connect to the server where the Certification Authority is installed, if necessary.
Select Start > Control Panel > Administrative Tools > Certification Authority.
In the Certification Authority (Local) tree, select Your Domain Name > Pending Requests.
Select the CSR in the right navigation pane.
In the Action menu, select the ID number of the request > Issue.
Close the Certification Authority window.
Download the Certificate
In your web browser address bar, type the IP address of the server where the Certification Authority is installed, followed by certsrv.
Click the View the status of a pending certificate request link.
Select the certificate request with the time and date you submitted.
Select the encoding format for the downloaded certificate, such as Base 64 for a PEM certificate.
Click Download CA certificate to save the certificate. The certificate will have .CER extension
Install the Certificate
Navigate to the server where the certificate needs to be installed.
Open a MMC console as Administrator and add Certificate snap-in under Local Computer
Expand Personal node and right click the Certificates node. 
Select All Tasks –> Import
Click Next
Locate the downloaded certificate file
Click Next
Place it under Personal node
Click Next
Click Finish

 

 

[Disease]

Brilliant, great info thank you.

 

Ian

[KK20]

yes, a domain CA is quite useful.  Do you run powershell scripts at startup?  Then think about "signing them" from your a Domain CA issued "code signing" certificate too, then you can harden script execution policies on your domain.  Do you use WIFI for your domain devices with a "known to you password"?  Move to radius and 802.1x with a domain CA machine certificate so no more WIFI passwords.

 

Want to run a guest network portal with something like OPNsense (good for linking devices to school email and voucher codes for real guests)?  letsencrypt and acme can do this so your guests dont need to install your domain CA cert.  If you use papercut mobile printing for guests, it is best to look at a letsencrypt for this, i recommend "win-acme" for windows servers and letsencrypt certs.  You will need a public IP pointing back to the win-acme running server.  Dont worry, you can use your internal DNS to do some directing inside your network for internal clients.

[jthompson]

I'm assuming you'd also need a domain CA in order to use LDAPS against AD as well.

 

Take note of the expiry date for the root CA certificate, as well as any other important server certificates, and ensure that they get renewed in plenty of time.

[Davit2005]

On 29/01/2026 at 11:01, Disease said:

Has anyone done this in their network, I want to get rid of annoying HTTPS warning for internal servers, any points of note or pitfalls?

 

Many Thanks

You could use a reverse proxy with a wildcard from LetsEncypt with DNS so you don't need to open up ports and no need to setup a CA purely for accessing such things as admin consoles.

Edited April 27 by Davit2005

[KK20]

On 27/04/2026 at 13:37, jthompson said:

I'm assuming you'd also need a domain CA in order to use LDAPS against AD as well.

 

Take note of the expiry date for the root CA certificate, as well as any other important server certificates, and ensure that they get renewed in plenty of time.

Not really.  All DCs have certificates, they have their own machine certificate.  As long as the "thing that is doing the LDAPS" trusts that domain controller certificate(s), then LDAPS will work.  A domain CA makes things easier because you can install the CA as a trusted root, so any certificate that is issued is trusted.  For new "things" you will only need to trust the CA not "each server that needs to be trusted). 

 

Simplified of course, im not going into the merits of offline CA + subCA.

[KK20]

On 27/04/2026 at 15:36, Davit2005 said:

You could use a reverse proxy with a wildcard from LetsEncypt with DNS so you don't need to open up ports and no need to setup a CA purely for accessing such things as admin consoles.

Even easier if you dont use ".local" as you can just change a few local DNS entries.

[FN-GM]

On 29/01/2026 at 21:31, Disease said:

 any points of note or pitfalls?

 

Yes - if you have to configured incorrectly, you can elevate yourself to Domain Admin quite easily. If you deploy it, run Ping Castle to see if it picks up any issues.