Internal Certificate Authority (CA) for Intranets (Windows Server Guide) Centralized SSL/TLS management for larger institutions
An internal certificate authority (CA) gives you full control over issuing and managing SSL certificates for your intranet. It's a common choice for larger banks and credit unions because it integrates tightly with Active Directory, helps maintain compliance and audit-ready requirements, and avoids per-certificate costs.
If you only need one or two certificates, a self-signed, standard, or wildcard SSL certificate might be easier. But for institutions with dozens of internal hosts, an internal CA is the way to go.
What You'll Need
- A Windows Server (2019 or later recommended)
- Active Directory domain (optional but recommended)
- Domain Admin or Enterprise Admin privileges
Step-by-Step: Set Up an Internal CA
- Install the AD CS Role
Open Server Manager > Manage > Add Roles and Features. Select 'Active Directory Certificate Services (AD CS)' and follow the wizard to install. - Configure the CA
After installation, use the 'AD CS Configuration' wizard. Choose 'Certification Authority' and 'Enterprise CA' if you're in a domain. Otherwise, use 'Standalone CA'. - Root or Subordinate
Most organizations start with a 'Root CA' for simplicity. Larger institutions may also configure subordinate CAs. - Cryptography Settings
Select at least 2048-bit key length and SHA-256 or stronger hashing. - Define Validity Period
Common practice is 5-10 years for the Root CA certificate. - Complete the Wizard
Click through the summary and finish. You now have a functioning internal CA. - Distribute the Root Certificate
Use Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. Import the CA's root certificate so all domain-joined devices trust it. - Issue Certificates
You can now request SSL/TLS certificates from the CA using MMC (Certificates snap-in) or by configuring auto-enrollment via Group Policy.