Active Directory Certificate Services documentation

Active Directory Certificate Services (AD CS) provides public key infrastructure (PKI) for cryptography, digital certificates and signature capabilities.

About Active Directory Certificate Services

What's new

• What's New in Active Directory Certificate Services?

Overview

• What is Active Directory Certificate Services?
• Post-quantum cryptography in AD CS overview
• What is ML-DSA support in AD CS?

Get started

Concept

• Certification Authority role service
• Certification Authority Web Enrollment
• Certificate Enrollment Web Service
• Certificate Enrollment Policy Web Service
• Network Device Enrollment Service

How-To Guide

• Configure a certification authority to use ML-DSA
• Configure certificate templates for ML-DSA
• Configure Online Responders (OCSP) to use ML-DSA
• Configure Network Device Enrollment Service to use a domain user account
• Disable weak cryptographic algorithms
• Migrate a Certification Authority key to a Key Storage Provider
• Configure trusted root and disallowed certificates
• Use a policy module with Network Device Enrollment Service
• Key-based certificate renewal
• Perform a Delegated Installation for an Enterprise Certification Authority

More information

Training

• Implement and manage Active Directory Certificate Services
• Deploying an AD CS Two-Tier PKI Hierarchy

Reference

• ADCSAdministration PowerShell module
• ADCSDeployment PowerShell module