Deploy Microsoft Certificate Services

Abstract

For some purposes it makes more sense to deploy an “in-house” PKI completely owned and controlled by an organization, for digital certificates used in that organization. The cost per certificate can be quite low, and the organization is in the best position to validate the identity of employees of that organization. There are several products available for this purpose, but Microsoft provides one with every license for Windows Server called Active Directory Certificate Services. It can be tightly integrated with Active Directory, where the organization already has much of the information needed on every certificate applicant. This makes validation much easier than with an external “public” CA. It also allows for considerable automation and simple integration with other Microsoft products.