Skip to main content
Confirm that CryptoHub 7.2.0.9 or later is installed before configuring the CA hierarchy.

​
Supported versions

  • CryptoHub 7.2.0.9

​
CryptoHub access

Prepare the following CryptoHub resources and access:
  • Two CryptoHub administrator identities for dual-control service and PKI operations.
  • Permission to create certificate containers, root CAs, services, endpoints, roles, and key stores.

​
Windows Server access

Prepare a Windows Server that has:
  • Local administrator access for installing the AD CS role and registering the machine-wide CNG provider.
  • Active Directory domain membership if you plan to deploy an enterprise subordinate CA.
  • The AD CS Certification Authority role, or permission to install it during this guide.

​
Certificate revocation

Before AD CS installs the subordinate CA certificate or issues a certificate, Windows checks whether the subordinate CA certificate is revoked. Windows needs a certificate revocation list (CRL) from the root CA to complete this check. If no CRL is available, the check fails with CRYPT_E_NO_REVOCATION_CHECK (0x80092012) and the CA denies certificate requests. This guide configures AD CS to ignore missing revocation information. AD CS then cannot detect a revoked subordinate CA certificate. Confirm that your PKI policy accepts this risk before you begin.

​
Network and TLS

Allow outbound TCP port 443 from the Windows Server to the CryptoHub FQDN. The CryptoHub Client Library uses the REST API over TLS.
TLS inspection can replace the CryptoHub server certificate and break authentication. Exempt the CryptoHub FQDN from TLS inspection while keeping certificate and hostname verification enabled in cryptohub.json.
Confirm connectivity from an elevated PowerShell session:
The result must show TcpTestSucceeded : True.

​
Files transferred between systems

Only public PKI artifacts cross the administrative boundary during CA enrollment:
  • The AD CS subordinate certificate signing request moves from Windows Server to CryptoHub.
  • The signed subordinate certificate and root certificate move from CryptoHub to Windows Server.
  • Neither CA private key is included in these files.
Continue to Prepare CryptoHub.