How can I install the Certificate Authority (CA) service in Windows Server 2003?

How can I install the Certificate Authority (CA) service in Windows Server 2003?

Windows Server 2003 can be used as a Certificate Authority (also known as CA) to provide extended security by offering support for Digital Certificates.

Digital Certificates can be granted to users based upon their roles and group membership. For example, a regular user that wants to enroll for a certificate will only be allowed to enroll for a specific set of Digital Certificates, while another user that is a member of the Domain Admins group will be allowed to enroll for a different set of certificates that can be used for a variety of functions, including Recovery Agents, IPSec, SSL and so on.

User Digital Certificates are valid for different purposes, including:

1. Allowing data on disk to be encrypted
   
2. Protecting e-mail messages
   
3. Proving the user's identity to a remote computer
   and more.

Note: There may be scenarios where a company might opt to use 3rd party issued Digital Certificates instead of creating their own, especially when that company's users will be dealing with out-of-the-company users, exchanging encrypted e-mail messages between themselves and these outside users, or when using SSL on a secured web site. This is because the outside users might not be willing to trust the company's internal CA.

Step 1: Install the IIS Service
In order to install the CA you will first need to install IIS on a Windows Server 2003 computer. On Windows Server 2003 IIS is not installed with the default Windows 2003 installation.

1. Click Start > Control Panel > Add or Remove Programs.
   
2. In Add or Remove Programs, click Add/Remove Windows Components.
   
3. Under Components, click on Application Server (but do NOT select it) and press on the Details button.
   
4. In the Application Server window click to select IIS and click Ok.
   
   
5. Click Next
   
6. After the wizard completes the installation, click Finish.

Step 2: Install the CA Service:

1. To install the CA service perform the following steps:
   
2. Click Start > Control Panel > Add or Remove Programs.
   
3. In Add or Remove Programs, click Add/Remove Windows Components.
   
4. Under Components, select Certificate Services.
   
   
5. You will get a warning about domain membership and computer renaming constraints, and then click Yes.
   
   
6. On the CA Type page, click Enterprise root CA, and then click Next.
   
   
7. On the CA Identifying Information page, in the Common name for this CA box, type the name of the server, and then click Next.
   
   
8. On the Certificate Database Settings page, accept the defaults in the Certificate database box and the Certificate database log box, and then click Next.
   
   
9. You will get a prompt to stop Internet Information Services, click Yes.
   
10. Enable Active Server Pages (ASPs), by clicking Yes.
    
11. When the installation process is completed click Finish.

Step 3: Obtain a User Digital Certificate from the CA

After installing and configuring the CA on your domain you will now need to ask your users (at least those who will require message security) to enroll for a Digital Certificate.

How do I obtain a Digital Certificate from my Certificate Authority (CA)?

Method #1 - By using a custom MMC

In this method a user will need to open a custom MMC and enroll by use of the MMC GUI.
In order to obtain a Digital Certificate by use of a custom MMC please perform the following steps:

1. Go to the Start menu > Run > type MMC and press Enter.
   
2. In the MMC window, go to the File menu and select Add/Remove Snap-In.
   
3. In the Add/Remove Snap-In window press the Add button.
   
4. Select Certificates from the available list of snap-ins and click Add.
   
5. In the user attempting this action is a member of the Domain Admins or Administrative groups he or she will be presented with a Certificates Snap-In window, asking whether the certificate will be issued to the user account, the computer or a service running on the computer. We will choose My User Account. Click Finish.
   
6. Expand Certificates - Current User > Personal.
   Note: There may be a Certificate folder under the Personal folder. Ignore it for now.
   
7. Right-click the Personal folder and select All Tasks > Request New Certificate.
   
   
8. In the Certificate Request wizard click Next.
   
   
9. In the Certificates Type select User.
   Note: Depending on the groups your user account belongs to, you might also see other certificate types. Ignore them for now.
10. In the Friendly name type a name for the certificate, for example "Daniel's User Certificate" or similar.
    Lamer note: Use your own name... duh...
    
    Click Next.
    
11. In the final page of the wizard click Finish. If all went well (and there is no reason why it won't) you'll get a confirmation message. Acknowledge it.
    
    You now have a new Digital Certificate. You can view it by going to the Certificates - Current User > Personal > Certificates folder within the current MMC window. Double-click on the new certificate and inspect the information found in it.
    
    Method #2 - By using a web browser:

In this method a user will need to open his or her web browser and surf to a given URL - that in fact is the URL for the online CA.
In order to obtain a Digital Certificate by use of a a web browser please perform the following steps:

1. Open an Internet browser such as Internet Explorer, Opera or Firefox.
   
2. In the address bar type the following URL:
   http://server_name/certsrv
   where server_name is the FQDN or the IP of the server that is hosting the CA.
   
3. In the Welcome screen click "Request a certificate".
   
   
4. In the "Request a certificate" screen click "User Certificate".
   
   
5. In the "User Certificate - Identifying Information" window, if a warning message appears telling you that there is a Potential Scripting Violation click Yes.
   
   
6. Click Submit.
   
   
7. In the "Certificate Issued" window click on "Install this certificate".
   
   
8. When the "Certificate Installed" window screen close the browser window.

You now have a new Digital Certificate. You can view it by going to the Tools > Internet Options > Content tab within the current Internet Explorer window. Click on the Certificates button. Look for the new certificate in the Personal tab, double-click on it and inspect the information found within.

You can also choose to export your new certificate by selecting the certificate and pressing the Export button.