Add a Windows ADCS issuer

In this guide, you add an ADCS certificate authority (CA) to ITVA as an issuer. You then import the CA's certificate templates and turn on the templates that users can request certificates from.

ITVA runs PowerShell commands on the CA server through the server's probe, over WinRM. It uses certutil and Get-CATemplate to read the CA, certreq to issue certificates, and certutil to revoke them.

Before you begin

• Your ITVA role can manage Issuers and CA Templates.
• The Windows server that runs the CA is a device in ITVA, with the vendor Windows Server, a probe, and a credential. Test Connection succeeds for the device. To set this up, see Enable WinRM on Windows Server.
• The account in the device's credential can request certificates from the CA templates that you plan to use. To revoke certificates, or to issue from a standalone CA, the account also needs the Issue and Manage Certificates permission on the CA.

Add the issuer

1. In the portal, go to Inventory > Issuers.
2. Select New Certificate Issuer.
3. In Name, enter a name for the issuer. The name must be unique in your organization.
4. In Kind, select Active Directory Certificate Services.
5. In Device, select the Windows server that runs the CA.
6. Select Save. The portal opens the page for the new issuer.

Import the CA templates

1. On the issuer page, select Sync. The portal shows a message that the issuer is scheduled for sync.
2. Wait a minute, then refresh the page.

The sync adds the CA templates to the Certificate Authority Templates card on the issuer page:

• Enterprise CA: ITVA adds one template for each certificate template that the CA publishes.
• Standalone CA: a standalone CA has no certificate templates. ITVA adds one template with the name of the CA, and marks it Standalone.

The sync imports templates only. It does not import the certificates that the CA already issued. ITVA does not sync on a schedule, so select Sync again after you publish a new template on the CA. A new sync updates the templates that ITVA already has. It does not make duplicates.

Turn on the templates

Imported templates are off. Users who cannot manage CA templates see only the templates that are on, so they cannot request a certificate until you turn on a template.

1. On the issuer page, in Certificate Authority Templates, turn on the Enabled switch for each template that users can request certificates from.
2. Optional: Open a template and select Edit. In Private Key Algorithms, select the key algorithms that certificates from this template can use. In Organization Information, enter the values that new enrollment requests start with.
3. Optional: For a standalone CA, select the extended key usages in the same form. A standalone CA issues the key usages that the request asks for. An enterprise CA applies the key usages from its own template.
4. If you edited the template, select Save.

Check that it worked

1. Go to Inventory > CA Templates.
2. Make sure that the templates show with your issuer in the Issuer column, and that the templates you turned on show as enabled.

Users can now select these templates when they create an enrollment request.

Troubleshooting

If the portal shows "device must be a server" when you save the issuer, the device is not a server. Select a device with the vendor Windows Server.

The portal does not show sync errors. If no templates show after a sync, do these checks:

1. Open the CA server's device page and select Test Connection. If the test fails, fix the connection first.
2. Sign in to the CA server with the account from the device's credential, and open PowerShell.
3. Run the commands that the sync runs. Each command must return output without an error.

certutil -getconfig
certutil -getreg CA\CAType
Get-CATemplate | Select Name

If certutil -getconfig fails, the server cannot find a CA. Make sure that the device is the server that runs the CA. If Get-CATemplate is not found or fails on an enterprise CA, ITVA cannot read the templates. Run it on the CA server itself, with an account that can manage the CA.

If issuing a certificate later fails with an access error, the account cannot enroll for that template. Give the account the Enroll permission on the template in the CA, or use a different template.