A CA is a CA and that's a CA.

When I was at Microsoft helping customers design new PKI deployments, I made every one of them repeat that out loud. To the rhythm of Popeye. Yes, it was silly. No, I didn't stop making them do it.

A Certification Authority is a system that exists to do exactly one thing. The fewer additional roles, agents, and integrations it has, the smaller its attack surface, and the harder it is to compromise the keys that anchor your entire identity infrastructure. Often beyond Active Directory, depending on where your root is trusted.

One job

The CA hosts only the Certification Authority role. No file server. No DNS. No domain controller. No IIS for the CRL distribution point. One job.

Limit the agents on it. Monitoring, EDR, fine. Backup agents you can usually skip. A scripted CA database backup that dumps to a file share, where your backup system picks it up, is safer than installing the vendor agent on the CA itself. The downloadable handout linked above lays out what belongs on a CA — and what's just attack surface.

The line you don't cross

Don't back up the private key that way. If your CA's private key is HSM-backed, the HSM has its own backup procedure. Use it. If the private key sits on the system disk, avoid VM snapshots and system-state backups. Each one is another copy of the key, sitting somewhere outside the CA, that someone could use to sign certificates your entire Active Directory will accept.

Three issues I see most often

When reviewing existing deployments, three patterns recur:

  • The hostname of the server is part of the CA name (CA01-PKI-PROD or similar)
  • The X.509 subject name is malformed or missing values it should have
  • IIS is running on the CA to host the CRL distribution point out of the local ADCS certsrv folder

The middle one is almost always panic. People see "Distinguished Name" in the install GUI, assume they'll break something by touching the defaults, and leave them alone. They wouldn't have. I've corrected Microsoft folks on this more than once.

CDP is a whole conversation. We'll come back to it.

For now, say it with me. A CA is a CA and that's a CA.

From the field

Once inherited a CA that was also a DC, also hosted the backup share for the CA database, and ran a backup agent that backed up its own keys to itself. The customer asked what to fix first. I asked if there was a CA we could use that wasn't this one.