Skip to content
Docs sslbrain sslbrain.com

Internal certificates from Windows CA

Copy link to the page “Internal certificates from Windows CA”

Connect your Windows CA so internal certificates are issued, renewed and installed automatically.

Certificates for internal names

Copy link to the section “Certificates for internal names”

Windows CA is a certificate source of type Internal CA, used for names such as intranet.company.local.

What you need

Copy link to the section “What you need”
  • Enterprise with the Windows CA add-on.
  • An approved service agent on a Windows server that can reach the CA.
  • A published certificate template with Supply in the request. The service agent server’s computer account needs Read and Enroll on the template.

Connect the CA and create the installation plan

Copy link to the section “Connect the CA and create the installation plan”

  1. Open Certificates › Sources › Add certificate source and select Windows CA.

  2. Give the certificate source a Name and select the Service agent.

  3. Click Find CAs through the agent and select your CA under CA configuration (Server\CA name). Wait for the service agent’s response.

  4. Click Fetch templates through the agent and select the published Template. Restrict Key types to those accepted by the template.

  5. Click Next, select Internal names under Used for and click Test and save.

  6. Open Create installation plans automatically for the server. Check that internal names use your internal certificate source, then click Create and start N installation plans.

Check that it works

Copy link to the section “Check that it works”

Once the installation plan has ordered the certificate, the source shows Windows CA request with status Issued and Request ID on the CA. The same Request ID appears under Issued Certificates in the CA console.

Then check that the service serves the certificate as described in step 8.

If it fails

Copy link to the section “If it fails”
  • The module is missing → ask an administrator to select Enable module and restart. After signing in, use Continue setup on the certificate source.
  • The CA list is empty → enter the CA configuration as server.company.local\Company CA. If the template is missing, enter its name, such as WebServer, rather than its display name.
  • The CA denies access or rejects the template → grant the computer account Read and Enroll and publish the template on the CA. The default WebServer template does not grant ordinary computer accounts Enroll.
  • The status is Awaiting approval → approve the request under Pending Requests on the CA. The source checks it every 15 minutes.
  • The source shows The last request failed → read the reason there and under Failed Requests on the CA. If the service agent does not respond, check the sslbrainagent service on the server and update the service agent if the task is rejected.
  • The client does not trust the certificate → make sure the client trusts your internal CA, for example through Group Policy.

Use the certificate profile for internal names

Copy link to the section “Use the certificate profile for internal names”

Selecting Used for › Internal names sets up the certificate profile. Adjust source order and key requirements under Certificates › Profiles (certificate profiles). A schema version 1 template accepts RSA only.

The appliance creates the private key and certificate request. The service agent sends only the request to the CA. The key is sent to the server when the installation plan installs the certificate.