How-To: Create a Subordinate ADCS CA in EZCA
In this page we will guide you on how you can create your own Issuing SSL CA and chain it up to a Root CA (EZCA Root or Offline Root).
To connect to your ADCS CAs it is required for a domain joined machine to run the EZCA certificate agent web service. This web service receives authenticated requests from EZCA and then requests the certificate on behalf of EZCA. Follow these steps to complete the ADCS connection.
Please note that managing your own Certificate Authority is complex and it can be easy to make mistakes. We recommend using a PKI as a service solution such as EZCA to avoid the complexity of managing your own CA. However if you are using your own CA, please follow the steps below to connect your EZCA instance to your ADCS CA. Help with this setup is not included in your regular EZCA Support, if you would like a Keytos engineer to help you setup your ADCS agent, please see our Keytos Professional Services for more information.
In this page we will guide you on how you can create your own Issuing SSL CA and chain it up to a Root CA (EZCA Root or Offline Root).
In this page we will walk you through how to set up your ADCS CA to have an enrollment agent certificate and use that enrollment certificate to issue certificates.
For EZCA to connect to your ADCS CAs it is required for a domain joined machine to run the EZCA certificate agent web service. Follow these steps to set up the EZCA ADCS agent.
The last step to linking EZCA to your existing ADCS CAs is registering the CA in EZCA. Once linked, EZCA enables your ADCS CA to connect to the latest protocols such as ACME and automatic AKV certificate creation.