26 lines
2.2 KiB
Markdown
26 lines
2.2 KiB
Markdown
A stand-alone root CA is the anchor of trust for the basic lab setup. It will be used to issue certificates to the subordinate issuing CA. Because it is critical to the security of the public key infrastructure (PKI), this CA is online in many PKIs only when needed to issue certificates to subordinate CAs.
|
|
**To set up a stand-alone root CA**
|
|
|
|
1. Log on to TEST_CA_ROOT1 as an administrator.
|
|
2. Start the Add Roles Wizard. On the **Select Server Roles** page, select the **Active Directory Certificate Services** check box, and then click **Next** two times.
|
|
3. On the **Select Role Services** page, select the **Certification Authority** check box, and then click **Next**.
|
|
4. On the **Specify Setup Type** page, click **Standalone**, and then click **Next**.
|
|
5. On the **Specify CA Type** page, click **Root CA**, and then click **Next**.
|
|
6. On the **Set Up Private Key** and **Configure Cryptography for CA** pages, you can configure optional settings, including cryptographic service providers. However, for basic testing purposes, accept the default values by clicking **Next** twice.
|
|
7. In the **Common name for this CA** box, type the common name of the CA,==CBP-NPE-CA1==, and then click **Next**.
|
|
8. On the **Set the Certificate Validity Period** page, accept the default validity duration for the root CA, and then click **Next**.
|
|
9. On the **Configure Certificate Database** page, accept the default values or specify other storage locations for the certificate database and the certificate database log, and then click **Next**.
|
|
10. After verifying the information on the **Confirm Installation Options** page, click **Install**.
|
|
|
|
Root CA
|
|
Certutil -setreg CA\DSConfigDN "CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov"
|
|
Certutil -setreg CA\CRLPeriodUnits 6
|
|
Certutil -setreg CA\CRLPeriod "Months"
|
|
Certutil -setreg CA\CRLOverlapPeriodUnits 3
|
|
Certutil -setreg CA\CRLOverlapPeriod "Months"
|
|
Certutil -setreg CA\ValidityPeriodUnits 6
|
|
Certutil -setreg CA\ValidityPeriod "Years
|
|
Certutil -setreg CA\AuditFilter 127
|
|
**certutil** **-****setreg** ==ca\csp\alternatesignaturealgorithm== ==0==
|
|
**certutil** **-****setreg** ==ca\csp\cnghashalgorithm SHA256==
|
|
==net stop certsvc== ==&&== ==net start certsvc== |