🔐 Issuing SSL Certificates to Internal Web Servers (IIS/Exchange) Using AD CS

Hey there! So far, I’ve covered everything from installing AD CS to configuring auto-enrollment. Now it’s time to put those certificates to good use—let’s issue SSL certificates for internal web servers like IIS and Exchange Server.

Whether I’m setting up HTTPS for an intranet site or securing OWA/ECP for Exchange, using internal certificates via AD CS saves cost and simplifies trust within the domain.

---

🧠 Why Use AD CS for SSL?

• ✅ Cost-effective – No need to buy public certs for internal names
• ✅ Trusted by all domain clients (thanks to auto-published root CA)
• ✅ ✅ Easy to manage with certificate templates

---

🧰 Prerequisites

Before I begin, here’s what I make sure is ready:

• ✔️ Web server is domain-joined
• ✔️ A published Web Server certificate template
• ✔️ CA is up and running
• ✔️ Required ports (like 443) are open
• ✔️ IIS or Exchange roles installed

---

📄 Step 1: Create and Publish the Web Server Template

1. On the CA, open Certificate Templates Console
2. Right-click Web Server → Duplicate Template
3. Use a name like: Corp Web SSL
4. In the General tab:
   • Validity: 2 or 3 years
5. In the Request Handling tab:
   • Purpose: Signature
   • Allow private key export (optional)
6. In the Subject Name tab:
   • Select: Supply in the request (important for manual enrollment)
7. In the Security tab:
   • Add the server/computer account or a security group
   • Grant Enroll permissions

Save and close.

8. Go to CA Console → Right-click Certificate Templates → New → Certificate Template to Issue
9. Select Corp Web SSL

✅ The template is now published.

---

🖥️ Step 2: Request the Certificate (Manual Enrollment)

On the target server (e.g., IIS or Exchange):

Option 1: MMC Method (GUI)

1. Run mmc.exe
2. Add the Certificates snap-in for Computer Account
3. Navigate to: Personal → Certificates
4. Right-click → All Tasks → Request New Certificate
5. Select the MAHARJAN Web SSL template
6. Click More Information is required to enroll
7. Enter Common Name (e.g., web.internal.local)
   • Add SANs if needed (Subject Alternative Names)
8. Complete the enrollment

Option 2: PowerShell (Advanced)

Here’s a sample script I use to generate a cert with SANs:

$san = "dns=web.internal.local&dns=autodiscover.internal.local"
$csrParams = @{
    Subject = "CN=web.internal.local"
    Template = "MAHARJAN Web SSL"
    MachineContext = $true
    CertStoreLocation = "Cert:\LocalMachine\My"
    TextExtension = @("2.5.29.17={text}$san")
}
Get-Certificate @csrParams

---

🌐 Step 3: Bind the SSL Certificate in IIS

1. Open IIS Manager
2. Select your website
3. Click Bindings → Add → Choose:
   • Type: https
   • Port: 443
   • SSL Certificate: Choose the one you just enrolled
4. Click OK and restart IIS

For Exchange Server, use the Exchange Admin Center or PowerShell to assign the cert to services like IIS and SMTP.

---

🔍 Step 4: Verify the Certificate

From a domain-joined client:

• Open browser → Browse to https://web.internal.local
• You should see a valid HTTPS connection
• Click the padlock → View certificate → Check:
  • Issued by your Enterprise CA
  • Correct CN/SAN
  • Proper validity period

---

🧪 Pro Tips

• ✔️ Use SANs for services like Exchange (autodiscover, mail, etc.)
• 🔁 Certificates must be renewed before expiry (autoenrollment can be configured for servers too)
• 🔐 Don’t forget to backup the private key if needed for use on load balancers or reverse proxies

---

🧭 What’s Next?

Next, I’ll explain how to configure Certificate Revocation, CRLs, and OCSP, which are essential for certificate trust and health in an enterprise.