Before we deploy I would say you should decide several aspects.
First you should decide whether you need to deploy and off line rude C based on that decision.
You also need to decide if you are going to deploy a standalone route C or an enterprise route C usually
if you deploy a single layer C hierarchy which means that you deploy only a single c.
It is most common to choose an enterprise route C.
However if you deploy a two layer hierarchy with a subordinate C the most common scenario is to deploy
a standalone route C.
This makes the route C a more secure and allows it to be taken off line except for when it needs to
issue certificates for a new subordinate C is the next factor to consider in the operating system installation
type.
Both the desktop experience and the server core installations the nearest support to a DCF Server Core
installation provides a smaller attack surface and less administrative overhead and therefore you should
consider it for ADC s as an enterprise environment.
In Windows Server 2016 you also can use Windows power shell to deploy and manage the ADC s role.
You should be aware that you can not change computer names domain name or computer domain memberships
after you deploy SCA of any type on that computer.
Therefore it is important to determine this attributes before installing a C.
Let's review the following details about additional considerations.
The consideration number one cryptographic service provider that is used to generate a new key.
The default CSP is the RSA Microsoft software key storage provider any provider whose name contains
a number sine is A cryptography next generation provider.
The next consideration is the key character lands.
The default key lands for the Microsoft strong Cryptographic Provider is two thousand eighty forty eight
sorry characters.
This is a minimum recommend recommended value for a root C..
Although it is a best practice to chew the four thousand ninety six bit key The next consideration is
the hash algorithm that is used to silence or difficult issued by a CIA the default hash algorithm is
S H A 2 5 6.
In previous versions of Windows Server the default hash algorithm is S H A 1 while Windows Server 2016
ADC s still supports S H A 1 you should avoid it unless you specifically need to support older versions
of Windows operating system as e.g. one is no longer considered secure.
Another consideration is the related to period for certificates issued by SCA templates defined as a
default.
Well these four certificates you can choose various validity periods on various certificate templates
The next consideration is the status of the root server.
Is it online or off line.
You should deploy the root server as an off line stand alone see if possible.
This is list enhances security and safeguards the root certificate because it is not available to attack
over the network.
Now if you decide to deploy an off line standalone route C you should keep in mind some specific considerations
before you issue a subordinate certificate from the root C. You make sure that you provide at least
one certificate to revocation list distribution point or C DP and a ie a location that will be available
to all clients.
This is because if by default a standalone rootsy have a c DP and AIB located on itself.
Therefore when you take the route C of the network revocation check will fail because the city B and
a location will be inaccessible when you define this locations.
You should manually copy CRL and a information to that location and other consideration is that you
have to set a validity period for CRL is that the route CAA publishes to a long period of time.
For example one year.
This means that you will have to turn on the route C once per year to publish and use CRL and then you
will have a copy.
You have to copy it to a location that is available to clients.
If you fail to do so after the CRL on the route C expires revocation checks for all certificates will
also fail another consideration is that you have to use group policy to publish the route C certificate
to a trusted route c store or local server and client computers.
You must do this manually because a standalone C can not do it automatically.
Unlike an enterprise C you can also publish the routes C a certificate to edit is by using the server
to utilize the command line to.