A private PKI is not a system you run. It is a small number of dated obligations, two of which will take the estate down if missed, and a set of artefacts that have to survive the loss of the machines holding them. The operations article nobody writes.
By the end of this you have five certificate templates cloned, scoped and published, automatic enrolment working for machines, users and domain controllers, and a manual path for web server certificates. This is the article where the authority issues its first certificate.
A certificate template is a standing grant, not a form. Why cloning is mandatory rather than tidy, why supply-in-request is not the villain people think it is, and why one template setting quietly stopped working for domain authentication when strong mapping enforcement completed.
By the end of this you have an enterprise issuing CA signed by the offline root, publishing its revocation list to both web servers on its own schedule, validating clean in the enterprise PKI view, and deliberately unable to issue a single certificate until you design its templates.
The issuing authority is the machine that does all the work and carries all the risk. What Active Directory integration actually gives you, why a default installation can issue certificates the moment the service starts, and why the certificate it holds quietly shortens everything it signs.
By the end of this you have two web servers behind one name serving your root CA certificate and revocation list over HTTP, with the issuing CA able to publish to both directly and no replication technology between them. This is the article that makes the URLs the root recorded real.
The signing service can be offline for a week and nobody notices. Let the revocation list become unreachable and authentication fails across the estate for certificates that are perfectly valid. Why the distribution layer is the only part of a PKI that must be highly available, and how to build it so it is.
By the end of this you have a standalone offline root certificate authority built, its policy file and distribution points fixed before anything is signed, its first revocation list published with a year of margin, and its certificate and CRL exported ready for the web servers.
