What is an enterprise CA in Active Directory Certificate Services, and which role services make up a working AD CS installation?
An enterprise CA is integrated with Active Directory: it uses AD for templates, permissions and publishing, so domain members can get certificates automatically.
A standalone CA works without AD: every request is reviewed by hand and there are no certificate templates. An enterprise CA must run on a domain member. It reads certificate templates from AD, checks the requester's AD permissions on them, can issue certificates automatically (autoenrollment), and publishes its certificate and CRLs into AD so every domain member finds them. Offline root CAs are therefore standalone, and issuing CAs in a Windows domain are usually enterprise CAs.
The AD CS role services:
- Certification Authority: the CA itself; signs certificates and CRLs.
- Certification Authority Web Enrollment: the
/certsrvweb pages, where you paste a CSR, download a CA certificate, chain or CRL. - Certificate Enrollment Web Service (CES): enrollment over HTTPS for clients that cannot talk to the CA directly (other forests, non-domain devices). It runs under a service account, which needs to be in
IIS_IUSRS. - Online Responder: the OCSP service that answers "is certificate X revoked?".
- Not used in the CKTECK setup: the Certificate Enrollment Policy Web Service and the Network Device Enrollment Service (SCEP for routers and switches).
Go deeper:
Microsoft Learn: What is Active Directory Certificate Services? — the role services and what each one does.- Microsoft Learn: Certificate template concepts — why templates exist only for enterprise CAs.