On-premises public key infrastructure with Active Directory Certificate Services: hierarchy design, revocation, templates, and operations.
By the end of this you have trust distributed to domain members and a documented path for everything else, three-layer backups of both authorities stored off the machines that made them, a rehearsed annual root CRL procedure, and a one-page calendar somebody else can act on.
A private PKI is not a system you run. It is a small number of dated obligations, two of which will take the estate down if missed, and a set of artefacts that have to survive the loss of the machines holding them. The operations article nobody writes.
By the end of this you have five certificate templates cloned, scoped and published, automatic enrolment working for machines, users and domain controllers, and a manual path for web server certificates. This is the article where the authority issues its first certificate.
A certificate template is a standing grant, not a form. Why cloning is mandatory rather than tidy, why supply-in-request is not the villain people think it is, and why one template setting quietly stopped working for domain authentication when strong mapping enforcement completed.
By the end of this you have an enterprise issuing CA signed by the offline root, publishing its revocation list to both web servers on its own schedule, validating clean in the enterprise PKI view, and deliberately unable to issue a single certificate until you design its templates.
The issuing authority is the machine that does all the work and carries all the risk. What Active Directory integration actually gives you, why a default installation can issue certificates the moment the service starts, and why the certificate it holds quietly shortens everything it signs.
By the end of this you have two web servers behind one name serving your root CA certificate and revocation list over HTTP, with the issuing CA able to publish to both directly and no replication technology between them. This is the article that makes the URLs the root recorded real.
The signing service can be offline for a week and nobody notices. Let the revocation list become unreachable and authentication fails across the estate for certificates that are perfectly valid. Why the distribution layer is the only part of a PKI that must be highly available, and how to build it so it is.
