On-premises public key infrastructure with Active Directory Certificate Services: hierarchy design, revocation, templates, and operations.
The operations article says a private PKI is two dates. One of them has a rehearsed procedure and the other has had none until now. Renewing a certificate authority at half its life, what changes in the published files when you do, and the one failure that hits software-key hierarchies specifically.
By the end of this you have an inventory of everything the old authority issued, its replacements deployed, its ability to authenticate removed, its objects out of the directory, its key accounted for, and a document saying when its revocation list can finally stop. In the order that does not break anything.
Uninstalling the role is the fifth of nine steps and the least consequential one. The dangerous part is that certificates outlive the authority that signed them, the directory objects outlive the uninstall on purpose, and the documented procedure is written in an order that will take you down if you follow it literally.
Public certificate lifetimes are collapsing toward 47 days and the question arrives every week: does this mean our certificate authority has to reissue everything monthly. It does not, and the test for which certificates are affected is not the one most people apply.
Two very different requests arrive wearing the same words. One of them wants a clustered authority and the other wants a second one, and they are not interchangeable. What a second issuing CA actually buys, why you cannot steer enrolment between two of them, and the control point almost nobody uses.
Your certificate authority can sign with a post-quantum algorithm now. That is a real capability and it is not a migration you can perform, because an authority cannot be converted in place. Here is what ML-DSA actually protects, what it costs in bytes, and why the work is trust distribution rather than cryptography.
By the end of this you have a cloud issuing CA anchored to your own hierarchy, trust and SCEP profiles delivered to managed devices, and the subordinate CA template removed again. Plus the step people skip, which fails on the devices you did not test.
Everyone wants to know whether Intune Cloud PKI lets them delete the hierarchy they just built. It deletes NDES. It does not delete the PKI, and if you anchor it to your own root you have just made your annual revocation appointment matter to every managed device you own.
