Create Your Own Root CA (Certificate Authority) Server

This is just about Windows Server CA service related configuration. This helped me to practice certificate involved configuration in firewalls etc. Windows guys know these but to help networking guys carry out their labs, I am sharing what I did to create my CA server.

I am using Windows 2016 Server..

Go to Server Manager > Manage > Add Roles & Features

Next Next Next until you get Server Roles

Tick Active Directory Certificate Services

Again Hit Next Next Next until the following selection page and tick the following four items like I have done.

Then again Next Next Next and Install..

Now after the configuration finished, you can see the following blue highlighted line (Configure Active Directory Certificate Services on the destination server) on the results.

Hit Next on the optout window (credentials) and select the following 2 items only and hit Next.

(last 2 items should also be configured but because they reply on the 1st 2 items, they are only selected at the moment)

I selected Enterprise CA on the next window, and Root CA on the next window..

Selected Create a new private key on the next window and selected SHA 256 on the Cryptography window (most newer servers prefer this). 

Renamed the CA name to WIN-CA just because it is easy to remember and didn't change the other defaults on the following window.

Now I hit only Next Next Next without changing anything until I met Configure button on Confirmation page..

After the configuration succeeded it will ask "Do you want to configure additional role services?" This is just asking you whether you want to configure the 2 items which we skipped on the Role Services window.

Hit Yes..

Hit Next on the optout window and select the remaining 2 items and hit Next..

I selected CA name on the next page and hit Next, selected Windows Integration Authentication on the next window and hit Next again, selected Use the built-in application pool identity on Service Account for CES window.

Again selected Windows Integration Authentication on the next window and hit Next..

Select the Certificate we just created on the next window by clicking on it and hit Next..

Next window will configure them all..

Now the CA services configuration is over..

Go to the IP address of the server from a web browser and type http://ip-address/certsrv

You will be asked to give credentials, I used the administrator credentials.

Now here we can download the CA certificate from the last link.

Click on it and select Base 64 and click on Download CA Certificate on the next page.

On the right side of the snap I have pasted here the CA certificate from the CA server I created..