Home / server / Questions / 461988
Accepted
dtech
Asked: 2013-01-01 08:57:37 +0800 CST

Multiple CA's on Windows Server 2012

  • 772

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The main issuing (Enterprise) CA should have a certificate signed by the root CA.

Is this possible with just 1 Windows Server 2012 installation or do you really need to create multiple VM's with one CA each?

windows-server-2012

1 Answers

  1. Best Answer

    You can only have one AD CS certificate server at a time on a single instance of Windows Server OS.

    Edit: Also if you want to get serious about the physical security of the root CA, don't make it a VM. A VM can be booted up from the VM management console and then compromised. Make it a physical machine, use it to set up your policy CAs and issuing CAs, then pull the Ethernet cable out of the root CA machine and power it off. (Which you can't really do with an enterprise (AD-integrated) CA, but that's a whole different topic.)

    • 9