Microsoft windows 2003 server certificate authority
Large key character lengths provide optimal security; however, they can impact server performance and might not be compatible with legacy applications. It is recommended that you keep the default setting of On the CA Name page, keep the suggested common name for the CA or change the name according to your requirements. Ensure that you are certain the CA name is compatible with your naming conventions and purposes, because you cannot change the CA name after you have installed AD CS.
The default setting of five years is recommended. On the CA Database page, in Specify the database locations , specify the folder location for the certificate database and the certificate database log. If you specify locations other than the default locations, ensure that the folders are secured with access control lists ACLs that prevent unauthorized users or computers from accessing the CA database and log files. In Confirmation , click Configure to apply your selections, and then click Close.
Click the Name Servers tab. Click Add. Modify Zone Transfer Settings. Updated: May 9, You can use this procedure to control whether a Domain Name System DNS zone will be transferred to other servers and which servers can receive the zone transfer.
You can complete this procedure using either the DNS Manager snap-in or the dnscmd command-line tool. Membership in Administrators , or equivalent, is the minimum required to complete this procedure. Modifying zone transfer settings. To modify zone transfer settings using the Windows interface. Right-click a DNS zone, and then click Properties. On the Zone Transfers tab, do one of the following:.
If you allowed zone transfers, do one of the following:. Additional considerations. Removing the Doamin and then rerunning dcpromo works but the only thing I don't like is that. I would really like to create some different users on each server so that I will know which server is being used.
On option is to setup different domains in the same forest and use one single CA in any of the domains to enroll certificates to both domains.
I am going to talk to some of my co-workers and see what options will work best for our Testing purposes. But first I want to make sure I have my facts straight.
My first option is to remove the domain and re adding it. This will make my Server a backup server and my users will be replicated to both servers and they will use the same CA. My second option is to setup two different forests with a trust and use cross-forest enrollment.
Also if I do this option I will be able to use the same Certificates on both servers but I will be able to have different users setup on each servers. But since I changed my domain ServerR2. Would that be true?
If that is the case I may just lean towards creating a backup server as we previously discussed. Both options gives you the result of having one enterprise CA to issue all certificates. But having two forests option 2 with a trust and setting up cross-forest enrollment is a far more complex solution than just having both servers in the same domain!
A third option is to have two domains in the same forest making it possible to use the same enterprise CA with a less complex setup than using a cross-forest deployment. In any case you need to have two VMs for your two servers but you do not need to have the VMs on separate servers just because they do belong to different domains! Office Office Exchange Server.
Not an IT pro? SQL Server. Sign in. United States English. Home R2 Library Forums. Ask a question. Quick access. Search related threads. Remove From My Forums. Answered by:. Archived Forums. Search related threads.
Remove From My Forums. Asked by:. Archived Forums. Sign in to vote. Your help will be appreciated. Friday, August 13, PM. To request a digital certificate, you must either create a certificate authority CA or have access to one.
For testing purposes, you might want to set up a private certificate authority to issue certificates for code signing. The following steps outline the procedure for doing this on a Windows Server or Windows Server machine.
Also check the Advanced options box, and then click Next.