How to Install an Enterprise Root Certificate Authority with PowerShell
Applies to: Windows Server 2019, 2022 and 2025.
An Enterprise Root CA integrates with Active Directory and issues from templates. Larger environments should evaluate an offline standalone root and online issuing CA.
PKI changes affect trust across the organization. Use an approved certificate policy, offline backups and separation of duties. Visit networkmanager.info.
Prerequisites
- Approve hierarchy, name and validity.
- Use a dedicated secured server.
- Define CRL and AIA paths.
- Create offline backups.
Procedure
Step 1: Install role
Add CA tools.
Install-WindowsFeature ADCS-Cert-Authority -IncludeManagementToolsStep 2: Review cmdlet
Inspect configuration parameters.
Get-Help Install-AdcsCertificationAuthority -FullStep 3: Configure CA
Use approved cryptography and validity.
Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -CACommonName 'CORP Root CA' -CryptoProviderName 'RSA#Microsoft Software Key Storage Provider' -KeyLength 4096 -HashAlgorithmName SHA256 -ValidityPeriod Years -ValidityPeriodUnits 10Step 4: Protect key
Restrict CA administrators and record controls.
Step 5: Test publication
Issue only a controlled test after CRL/AIA validation.
Verification
Confirm CA service and configuration.
Get-Service CertSvc
certutil -getreg ca
certutil -cainfoRollback and recovery
Do not uninstall a production root as routine rollback. Before issuance, restore the clean system image; afterward use formal PKI decommissioning.
Security notes
An online root increases exposure of the trust anchor.
Official references
Explore Netcloud24 Canada.
