Hey there! So far, Iβve covered everything from installing AD CS to configuring auto-enrollment. Now it’s time to put those certificates to good useβletβs issue SSL certificates for internal web servers like IIS and Exchange Server.
Whether Iβm setting up HTTPS for an intranet site or securing OWA/ECP for Exchange, using internal certificates via AD CS saves cost and simplifies trust within the domain.
π§ Why Use AD CS for SSL?
- β Cost-effective β No need to buy public certs for internal names
- β Trusted by all domain clients (thanks to auto-published root CA)
- β β Easy to manage with certificate templates
π§° Prerequisites
Before I begin, hereβs what I make sure is ready:
- βοΈ Web server is domain-joined
- βοΈ A published Web Server certificate template
- βοΈ CA is up and running
- βοΈ Required ports (like 443) are open
- βοΈ IIS or Exchange roles installed
π Step 1: Create and Publish the Web Server Template
- On the CA, open Certificate Templates Console
- Right-click Web Server β Duplicate Template
- Use a name like:
Corp Web SSL - In the General tab:
- Validity: 2 or 3 years
- In the Request Handling tab:
- Purpose: Signature
- Allow private key export (optional)
- In the Subject Name tab:
- Select: Supply in the request (important for manual enrollment)
- In the Security tab:
- Add the server/computer account or a security group
- Grant Enroll permissions
Save and close.
- Go to CA Console β Right-click Certificate Templates β New β Certificate Template to Issue
- Select
Corp Web SSL
β The template is now published.
π₯οΈ Step 2: Request the Certificate (Manual Enrollment)
On the target server (e.g., IIS or Exchange):
Option 1: MMC Method (GUI)
- Run
mmc.exe - Add the Certificates snap-in for Computer Account
- Navigate to:
PersonalβCertificates - Right-click β All Tasks β Request New Certificate
- Select the
MAHARJAN Web SSLtemplate - Click More Information is required to enroll
- Enter Common Name (e.g.,
web.internal.local)- Add SANs if needed (Subject Alternative Names)
- Complete the enrollment
Option 2: PowerShell (Advanced)
Hereβs a sample script I use to generate a cert with SANs:
$san = "dns=web.internal.local&dns=autodiscover.internal.local"
$csrParams = @{
Subject = "CN=web.internal.local"
Template = "MAHARJAN Web SSL"
MachineContext = $true
CertStoreLocation = "Cert:\LocalMachine\My"
TextExtension = @("2.5.29.17={text}$san")
}
Get-Certificate @csrParams
π Step 3: Bind the SSL Certificate in IIS
- Open IIS Manager
- Select your website
- Click Bindings β Add β Choose:
- Type: https
- Port: 443
- SSL Certificate: Choose the one you just enrolled
- Click OK and restart IIS
For Exchange Server, use the Exchange Admin Center or PowerShell to assign the cert to services like IIS and SMTP.
π Step 4: Verify the Certificate
From a domain-joined client:
- Open browser β Browse to
https://web.internal.local - You should see a valid HTTPS connection
- Click the padlock β View certificate β Check:
- Issued by your Enterprise CA
- Correct CN/SAN
- Proper validity period
π§ͺ Pro Tips
- βοΈ Use SANs for services like Exchange (
autodiscover,mail, etc.) - π Certificates must be renewed before expiry (autoenrollment can be configured for servers too)
- π Donβt forget to backup the private key if needed for use on load balancers or reverse proxies
π§ Whatβs Next?
Next, Iβll explain how to configure Certificate Revocation, CRLs, and OCSP, which are essential for certificate trust and health in an enterprise.