How to deploy and configure a standalone CA server in your domain

A quick visual guide on deploying a stand-alone Certificate Authority (CA) server for your test lab. This will come handy if you are looking to monitor guest servers deployed in DMZ, Amazon EC2 or anywhere else beyond your domain.

For those who are trying to set up SCOM agents in DMZ or in the Amazon cloud, here is a quick instruction on how to deploy your own Certificate Authority (CA). This is useful for smaller virtual labs, not for production systems. If you are looking to implement a “real” solution, please spend some time with your domain admins, they most likely have a better solution for you.

There are four parts:

Install CA server.

Step 1: Install and Configure Certification Authority (CA) on External Domain Server

• • Open “Server Manager” console and run “Add Roles” Wizard:
  • Check “Active Directory Certificate Services” Role. Click Next:
  • On “Role Services” page check “Certification Authority” and “Certification Authority Web Enrollment” services: If wizard asks about installation of additional features – it is OK:
  • On “Setup type” page check Standalone option:
  • “CA Type” page: check Root CA.
  • “Private Key” page: check Create a new private key.
  • Leave “Cryptography”, “CA Name”, “Validaty Period”, “Certificate Database”, “WebServer(IIS)”, “Role Services” by default.
  • Confirm and Finish Installation.

  Step 2: Download the Trusted Root (CA) certificate

  • • Open in browser http:///certsrv , where network name of your CA server.
    • Click “Download a CA certificate chain or CRL”.
    • Download CA certificate.

    Step 3: Import the Trusted Root (CA) certificate

    Note: CA root certificate should be imported on all machines on the DBC (Virtualization Hosts and Management Stack) and on customer’s SCOM RMS.

    • • Doubleclick CA certificate
      • Click Install Certificate…
      • Click Next. Then Check “Place all certificates in the following store”
      • Click Browse. Check “Show physical stores”, browse to “Trusted Root Certification Authorities” and select “Local computer”.
      • Finish Wizard and Close Certificate properties window.

      Congratulations, now you have your very own CA server.