# Install the AD CS role (no management tools needed on Server Core)
Install-WindowsFeature ADCS-Cert-Authority

# Configure as Standalone Root CA
Install-AdcsCertificationAuthority `
    -CAType StandaloneRootCA `
    -CACommonName "Contoso Root CA" `
    -KeyLength 4096 `
    -HashAlgorithmName SHA256 `
    -ValidityPeriod Years `
    -ValidityPeriodUnits 20 `
    -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
    -Force

# Root CA validity for certificates it issues (SubCA certs)
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"

# Force CRL overlap period (prevents gaps during slow publishing)
certutil -setreg CA\CRLOverlapPeriodUnits 12
certutil -setreg CA\CRLOverlapPeriod "Hours"

# Root CA CRL publication interval (long — root rarely revokes)
certutil -setreg CA\CRLPeriodUnits 1
certutil -setreg CA\CRLPeriod "Years"

Restart-Service certsvc

# Install role and management tools
Install-WindowsFeature ADCS-Cert-Authority, RSAT-ADCS-Mgmt

# Configure as Enterprise Subordinate CA
Install-AdcsCertificationAuthority `
    -CAType EnterpriseSubordinateCA `
    -CACommonName "Contoso Issuing CA 01" `
    -KeyLength 4096 `
    -HashAlgorithmName SHA256 `
    -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" `
    -OutputCertRequestFile "C:\CARequest\IssuingCA.req" `
    -Force

# On Root CA — sign the SubCA request
certreq -submit -attrib "CertificateTemplate:SubCA" IssuingCA.req IssuingCA.cer

# On Issuing CA — install the signed certificate
certutil -installcert C:\IssuingCA.cer
Restart-Service certsvc

# On the Issuing CA — set CDP and AIA extensions
# Replace pki.contoso.com with your actual PKI web server FQDN

$crlURL   = "http://pki.contoso.com/pki/%3%8%9.crl"
$aiaURL   = "http://pki.contoso.com/pki/%2%3.crt"
$ocspURL  = "http://ocsp.contoso.com/ocsp"
$ldapCRL  = "ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10"
$ldapAIA  = "ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11"

# Remove defaults, then add clean URLs
certutil -setreg CA\CRLPublicationURLs "1:$env:SystemRoot\System32\CertSrv\CertEnroll\%3%8%9.crl\n10:$ldapCRL\n2:$crlURL"
certutil -setreg CA\CACertPublicationURLs  "1:$env:SystemRoot\System32\CertSrv\CertEnroll\%2%3.crt\n3:$ldapAIA\n32:$aiaURL\n2:$ocspURL"

Restart-Service certsvc

# Publish CRL immediately after restart
certutil -crl

# On your PKI web server
Install-WindowsFeature Web-Server, Web-Mgmt-Console

# Create virtual directory pointing to CertEnroll share
# IIS Manager → Default Web Site → Add Virtual Directory
# Alias: pki   Physical path: \\IssuingCA\CertEnroll

# Allow double escaping (required for delta CRL filenames with '+')
# In IIS, select the /pki vdir → Request Filtering → Edit Feature Settings
# → Allow double escaping: True

<configuration>
  <system.webServer>
    <security>
      <requestFiltering allowDoubleEscaping="true" />
    </security>
    <staticContent>
      <mimeMap fileExtension=".crl" mimeType="application/pkix-crl" />
      <mimeMap fileExtension=".crt" mimeType="application/pkix-cert" />
    </staticContent>
  </system.webServer>
</configuration>

# Issuing CA — recommended CRL settings
certutil -setreg CA\CRLPeriodUnits 1
certutil -setreg CA\CRLPeriod "Weeks"          # Base CRL published weekly

certutil -setreg CA\CRLDeltaPeriodUnits 1
certutil -setreg CA\CRLDeltaPeriod "Days"      # Delta CRL published daily

certutil -setreg CA\CRLOverlapPeriodUnits 12
certutil -setreg CA\CRLOverlapPeriod "Hours"   # Overlap prevents gaps

Restart-Service certsvc
certutil -crl   # Publish immediately

# Install OCSP responder role on a separate server (or the issuing CA)
Install-WindowsFeature ADCS-Online-Cert, RSAT-ADCS-Mgmt

# Configure via Server Manager GUI or:
Add-CAOnlineResponder `
    -OCSPUri "http://ocsp.contoso.com/ocsp" `
    -CAName "Contoso Issuing CA 01" `
    -UseAllCACerts

# List templates published on the issuing CA
certutil -catemplates

# Open the Certificate Templates MMC snap-in
certtmpl.msc

# Publish a template to the issuing CA
Add-CATemplate -Name "WebServer" -Force

# Audit for ESC1-vulnerable templates (supply subject + low-privilege enroll)
# Requires PSPKI module or Certify/Certipy tools
Import-Module PSPKI
Get-CertificateTemplate | Where-Object {
    $_.Settings.SubjectName -match 'EnrolleeSupplied' -and
    ($_.Security | Where-Object { $_.Principal -match 'Domain Users' -and $_.Rights -match 'Enroll' })
}

Group Policy Management → Create or Edit a GPO linked to the domain or OU

Computer Configuration → Windows Settings → Security Settings
  → Public Key Policies → Certificate Services Client - Auto-Enrollment
    → Enroll certificates automatically: Enabled
    → Renew expired certificates, update pending certificates: Checked
    → Update certificates that use certificate templates: Checked

User Configuration → Windows Settings → Security Settings
  → Public Key Policies → Certificate Services Client - Auto-Enrollment
    → (Same settings as above)

# Force GPO update and trigger certificate enrollment
gpupdate /force
certutil -pulse

# Check enrolled certificates
Get-ChildItem Cert:\LocalMachine\My
Get-ChildItem Cert:\CurrentUser\My

# View auto-enrollment events
Get-WinEvent -LogName "Microsoft-Windows-CertificateServicesClient-AutoEnrollment/Operational" |
    Select-Object TimeCreated, Message -First 20

# Install NDES
Install-WindowsFeature ADCS-Device-Enrollment, Web-Server, Web-Asp-Net45

# Configure NDES
Install-AdcsNetworkDeviceEnrollmentService `
    -ApplicationPoolIdentity `
    -RAName "Contoso NDES RA" `
    -RAEmail "pki@contoso.com" `
    -RACompany "Contoso" `
    -RADepartment "IT Security" `
    -RACity "London" `
    -RAState "England" `
    -RACountry "GB" `
    -SigningProviderName "Microsoft Strong Cryptographic Provider" `
    -EncryptionProviderName "Microsoft Strong Cryptographic Provider" `
    -Force

# Enable key archival on the CA
certutil -setreg CA\UseDefinedCACertInRequest 0

# Create a Key Recovery Agent (KRA) certificate
# Use the built-in "Key Recovery Agent" template
# The KRA account should be a dedicated service account, not a personal account

# Enable archival on an encryption certificate template
# Template Properties → Request Handling → Archive subject's encryption private key: Checked

# Find the archived key by requester or serial number
certutil -getkey <serial_number> output.blob

# Recover the key (requires KRA certificate and private key)
certutil -recoverkey output.blob recovered_key.pfx

# Enable all CA audit events
certutil -setreg CA\AuditFilter 127
Restart-Service certsvc

# List all issued certificates expiring within 60 days
certutil -view -restrict "NotAfter>=now,NotAfter<=(now+60:00)" `
    -out "RequestID,RequesterName,CommonName,NotAfter,CertificateTemplate"

# Export expiry report to CSV
certutil -view -restrict "NotAfter>=now,NotAfter<=(now+60:00)" `
    -out "RequestID,RequesterName,CommonName,NotAfter" csv > expiring.csv

# Back up the CA database and private key (interactive — prompts for password)
certutil -backupca -password P@ssw0rd! C:\CABackup

# Non-interactive version (for scheduled tasks)
certutil -backupdb C:\CABackup\DB
certutil -backupkey -password P@ssw0rd! C:\CABackup

# Alternatively, back up via CA MMC:
# certsrv.msc → Right-click CA → All Tasks → Back up CA

# Save as Backup-CA.ps1 and schedule via Task Scheduler
$BackupRoot = "\\fileserver\PKIBackups"
$Date       = Get-Date -Format "yyyy-MM-dd"
$BackupPath = "$BackupRoot\$Date"
$Password   = (Get-Secret -Name "CABackupPassword").Password  # from Windows Credential Manager

New-Item -ItemType Directory -Path $BackupPath -Force | Out-Null

certutil -backupdb "$BackupPath\DB"
certutil -backupkey -password $Password "$BackupPath"

# Verify backup integrity
certutil -verifystore "$BackupPath\*.p12" | Out-File "$BackupPath\verify.log"

# Retain 30 days of backups
Get-ChildItem $BackupRoot -Directory |
    Where-Object { $_.CreationTime -lt (Get-Date).AddDays(-30) } |
    Remove-Item -Recurse -Force

# Stop the CA service
Stop-Service certsvc

# Restore database
certutil -restoredb C:\CABackup\DB

# Restore private key
certutil -restorekey C:\CABackup\<CA>.p12 -password P@ssw0rd!

# Restart
Start-Service certsvc

# Assign roles via certutil or CA MMC
# certsrv.msc → Right-click CA → Properties → Security

# Add a dedicated Certificate Manager account
certutil -administer -addacct "CONTOSO\CA-CertMgr" "Certificate Managers"

☐ Root CA is offline and not domain-joined
☐ Issuing CA is on a dedicated Server Core (no GUI) member server
☐ CA server is not a domain controller
☐ All CA administrative roles are assigned to dedicated service accounts (not personal accounts)
☐ CA server has no internet access (outbound firewall rule)
☐ Physical access to CA server is restricted (server room, no KVM-over-IP)
☐ BitLocker enabled on CA server OS and data volumes
☐ TPM-bound BitLocker on the issuing CA (keys unlocked at boot by TPM)
☐ Uninstall Protection token stored in PAM vault, not in scripts
☐ CA audit logging enabled (AuditFilter = 127)
☐ CA database backup runs nightly; backup tested for restore quarterly
☐ CDP and AIA URLs resolve from all client networks
☐ CRL overlap period configured to prevent gaps
☐ No templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + open enroll ACL
☐ Template owners are Domain Admins or Enterprise Admins
☐ ESC1-8 assessment run (Certipy, Certify, or PSPKI audit)
☐ NDES server (if deployed) is in a separate tier, not the issuing CA
☐ Expiry alerting configured for CA certificate (flag at 90 and 30 days)
☐ Windows Firewall configured to allow only: RPC (for CA), LDAP (for AD queries), HTTP (CDPs), and management ports

# Allow inbound certificate enrollment (RPC endpoint mapper + dynamic ports)
New-NetFirewallRule -DisplayName "AD CS — RPC Endpoint Mapper" `
    -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow

New-NetFirewallRule -DisplayName "AD CS — RPC Dynamic" `
    -Direction Inbound -Protocol TCP -LocalPort 49152-65535 -Action Allow

# Allow inbound from PKI web server only (for CRL file sync)
New-NetFirewallRule -DisplayName "AD CS — CRL Sync" `
    -Direction Inbound -Protocol TCP -LocalPort 445 `
    -RemoteAddress "10.10.10.50" -Action Allow  # PKI web server IP

# Block all other inbound
New-NetFirewallRule -DisplayName "AD CS — Block All Other Inbound" `
    -Direction Inbound -Action Block -Priority 9000

# Find all certificate templates and assess for known misconfigurations
certipy find -u 'user@contoso.com' -p 'Password' -dc-ip 10.10.10.1

# Check for ESC1 (template allows subject supply + low-privilege enroll)
certipy find -vulnerable -u 'user@contoso.com' -p 'Password' -dc-ip 10.10.10.1

# Output a BloodHound-compatible JSON for visualisation
certipy find -u 'user@contoso.com' -p 'Password' -dc-ip 10.10.10.1 -bloodhound

# Fix ESC6 — remove the dangerous flag that allows SAN in any request
certutil -setreg CA\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
Restart-Service certsvc

# Revoke by serial number (get from CA database or certutil -view)
certutil -revoke <serial_number> 0   # 0 = Unspecified
certutil -revoke <serial_number> 1   # 1 = Key Compromise
certutil -revoke <serial_number> 5   # 5 = Cessation of Operation

# Publish updated CRL immediately after revocation
certutil -crl

# List all issued certificates
certutil -view -restrict "Disposition=20" -out "RequestID,RequesterName,CommonName,NotAfter"

# Find certificates for a specific user
certutil -view -restrict "RequesterName=CONTOSO\jsmith"

# Find all valid computer certificates
certutil -view -restrict "CertificateTemplate=Machine,Disposition=20"

# On the Issuing CA — generate a renewal request
certutil -renewCert ReuseKeys   # Keep same key pair
# or
certutil -renewCert             # Generate new key pair (preferred)

# Submit the .req to the Root CA (offline), install the returned .cer
certutil -installcert IssuingCA_Renewed.cer
Restart-Service certsvc