Welcome back! In this final part of my AD CS series, I’ll focus on something often overlooked—but critical: securing and maintaining your Enterprise Certificate Authority.
An improperly secured CA can lead to a full Active Directory compromise. So here’s what I always do to harden, monitor, and back up my CA environment.
🧱 1. Harden the CA Server (Baseline Security)
🧰 Core Steps I Always Follow:
- ✅ Remove unnecessary roles – CA should be a dedicated box
- ✅ Disable Internet access (except for CRL/OCSP publishing if needed)
- ✅ Apply latest Windows updates
- ✅ Use static IP and DNS
- ✅ Remove user logins (only admins allowed)
- ✅ Turn off SMBv1, legacy protocols
- ✅ Enable Windows Firewall and restrict inbound rules
🔐 2. Lock Down CA Permissions
🔧 Certification Authority Console > Properties > Security
- Only allow:
- Domain Admins or PKI Admin Group
- Authenticated users – only Read & Enroll (no Manage)
- Disable “Everyone” or “Domain Users” if present with high privileges
- Enable Auditing for
Issue and Manage Certificates
🔍 3. Enable Auditing for CA Activity
📝 Audit who requests, issues, revokes, or changes cert settings
- Enable audit policy:
- Run
secpol.msc→ Local Policies → Audit Policy - Enable:
- Audit object access
- Audit privilege use
- Audit policy change
- Run
- Then on the CA:
- Open CA console → Properties → Auditing tab
- Check:
- Issue/revoke certificates
- Start/stop services
- Change CA config
🔎 Review logs under Security Event Log and CA logs for anomalies.
🧯 4. Backup CA Configuration
This is mission-critical. I always schedule regular backups using the built-in tools.
🔁 Backup Steps:
# Export CA database and private key
certutil -backupdb "D:\CA_Backup"
certutil -backupkey "D:\CA_Backup"Also, export the CA certificate and private key using MMC > Certificates (Local Computer) > Personal > Export.
👉 I keep:
CA databasePrivate keyRegistry settings(HKLM\SYSTEM\CurrentControlSet\Services\CertSvc)CRL/AIA/OCSP configuration
💡 I store backups offline or in a secure vault (not on the CA itself).
🔄 5. Test CA Recovery (Once per year minimum)
I simulate a CA disaster recovery scenario using:
- A VM snapshot or cloned lab CA
- Importing backup DB + key
- Ensuring issued certificates still validate
🧪 This ensures business continuity if the CA ever fails or gets compromised.
🌐 6. Publish CRLs & AIA to Secure, Redundant Locations
- Use internal IIS or DFS shares
- Configure CRL Distribution Points (CDPs) in:
http://pki.domain.local/CRL/ca.crl
- Use multiple CDP URLs for HA
- Protect CRL files with strict NTFS permissions
🔐 7. Offline Root CA? Even Better!
For high-security environments, I deploy:
- 🖥️ Offline Root CA (only used once every few years)
- 🌐 Online Subordinate Enterprise CA (day-to-day operations)
This isolates the trust anchor and reduces attack surface.
🛡️ 8. Optional but Recommended Security Features
| Feature | Description |
|---|---|
| HSM (Hardware Security Module) | Store CA private key in tamper-proof hardware |
| EFS/BitLocker | Encrypt private key and backups |
| TPM-backed keys | On modern servers |
| Certificate Manager restrictions | Limit who can approve/revoke requests |
| Split admin model | Separate issuing CA admins from domain admins |
📑 Final Checklist
✅ Harden OS and network
✅ Limit and audit CA access
✅ Backup CA regularly
✅ Configure CRL and OCSP securely
✅ Test recovery procedures
✅ Consider Root CA isolation
✅ Monitor logs and events weekly
🧭 Wrapping It Up: The Full AD CS Journey
You’ve now walked through a full Enterprise PKI deployment with me: