Server Certificate Deployment

 

Applies To: Windows Server 2012

Follow these steps to install an enterprise root certification authority (CA) and to deploy server certificates for use with PEAP and EAP.

Important

To perform the steps in this guide, you must already have a server that is running Network Policy Server (NPS) and a server that is running the Web Server (IIS) server role. If you do not have an NPS server and a Web server, you cannot complete all of the steps in this guide. You must install these servers before performing the steps in this guide. For more information on how to accomplish these tasks, see the Windows Server® 2012 Core Network Guide at https://technet.microsoft.com/library/hh911995.aspx. Before you install Active Directory Certificate Services, you must name the computer, configure the computer with a static IP address, and join the computer to the domain. After you install AD CS, you cannot change the computer name or the domain membership of the computer, however you can change the IP address if needed. For more information on how to accomplish these tasks, see the Windows Server® 2012 Core Network Guide at https://technet.microsoft.com/library/hh911995.aspx.

 

• Create an Alias (CNAME) Record in DNS for WEB1

• Configure WEB1 to Distribute Certificate Revocation Lists (CRLs)

• Prepare the CAPolicy.inf File

• Install the Certification Authority

• Configure the CDP and AIA Extensions on CA1

• Copy the CA Certificate and CRL to the Virtual Directory

• Configure the Server Certificate Template

• Configure Server Certificate Autoenrollment

• Refresh Group Policy1

• Verify NPS Server Enrollment of a Server Certificate

Note

The procedures in this guide do not include instructions for cases in which the User Account Control dialog box opens to request your permission to continue. If this dialog box opens while you are performing the procedures in this guide, and if the dialog box was opened in response to your actions, click Continue.