Active Directory Certificate Services – 2016 in AWS

I am tasked with deploying Active Directory Certificate Service Chain on Windows 2016 Server platform.
Servers would be VMs hosted in AWS (except for the Root Authority), I need to make this environment highly available. My understanding is that OCSP is the service that is needing high availability the most. How do I make use of AWS services to insure High Availability? Is this possible?
mezenAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Adelaido JimenezDevOpsCommented:
To make the service High Available, I would suggest you put the Domain controller in two different availability zone in AWS. This will provide you with fault tolerance and will prevent a domain controller failure from impacting the availability of you servers. I would recommend reading this paper to get a better understanding https://docs.aws.amazon.com/quickstart/latest/active-directory-ds/vpc-rec.html.
2
mezenAuthor Commented:
Good read, I was referring to Certificate Services not Domain Services though.
0
Adelaido JimenezDevOpsCommented:
Ah I see. The concept would be the same, having the VM's in  different availability zones will help with high Availability  since the zones in AWS are not in the same geological location.
0
LearnctxEngineerCommented:
I need to make this environment highly available

You will need to look at using Windows Failover Clustering then, see the MS community Wiki on CA HA here (I have no idea if AWS fully supports Windows clustering). And the MS AD DS blog on OCSP HA here. OCSP is easy you just jam it between a load balancer (ELB). You do the same for your CRL's as well.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mezenAuthor Commented:
Great references.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
PKI CERTIFICATES

From novice to tech pro — start learning today.