How to implement PKI CA on windows 2008 server?

You need to create one in Notepad.  See the code snippet for an example.

Technically the capolicy.inf is optional - but without it you get default settings that may not be desirable.

Before using the example, you would need to enable the new algorithm set on the CA:
certutil -setreg ca\csp\DiscreteSignatureAlgorithm 1
net stop certsvc & net start certsvc

You will need to make sure these patches are rolled out to your XP/2003 boxes:
KB922706
KB938397
KB948963

Reading material:
http://download.microsoft.com/download/4/7/f/47f81ee5-8593-4b39-871d-2f55eb731ad6/Certificate%20Services%20Enhancements%20in%20Longhorn%20Server.doc

Version]
Signature="$Windows NT$"
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1 ; Server Authentication
OID = 1.3.6.1.5.5.7.3.2 ; Client Authentication
OID = 1.3.6.1.5.5.7.3.3 ; Code Signing
OID = 1.3.6.1.5.5.7.3.4 ; Secure Email
OID = 1.3.6.1.5.5.7.3.5 ; IP security end system
OID = 1.3.6.1.5.5.7.3.6 ; IP security tunnel termination
OID = 1.3.6.1.5.5.7.3.7 ; IP security user
OID = 1.3.6.1.5.5.7.3.8 ; Time Stamping
OID = 1.3.6.1.5.5.7.3.9 ; OCSP Signing
[certsrv_server]
renewalkeylength=4096
RenewalValidityPeriodUnits=20
RenewalValidityPeriod=years
CRLPeriod=weeks
CRLPeriodUnits=26
CRLOverlapPeriod=weeks
CRLOverlapUnits=2
CRLDeltaPeriodUnits=0
CRLDeltaPeriod=days
DiscreteSignatureAlgorithm=1

Select allOpen in new window

note: there should be an opening [ before Version...

hi,

i want to configure the PKI CA in windows 2008 server that is domain controler please help me

Regards,

Rajeeve

HI,

Our basic requrement is configure ssl and smart Card in windows 2008, please guide us

Regards

Rajeeve Jose

Hi
i am installed CA in standalone windows 2008 but how to run the scrip step 10 please advice me

Regards

Rajeeve Jose

The code snippet isn't a script.  Copy and paste it (with the opening [ I accidentally left out) into notepad and save as capolicy.inf in the c:\windows (%systemroot%) directory, then install AD CS.