Skip to main content
Prepare the CryptoHub side of the integration by creating the ML-DSA root CA, deploying a Microsoft ADCS client service, and granting the service access to the certificate container.

​
Create a certificate container

1
Log in to CryptoHub under dual control with your administrator identities.
2
In the left navigation, select PKI & CA, and then open Certificate Management.
3
Create a certificate container for the CA hierarchy, or select an existing container that is governed by the required access policy.
The certificate container appears in the Certificate Management table.

​
Create the ML-DSA root CA

1
Right-click the certificate container, and then select Add Certificate > New Certificate.
The certificate window opens with Subject DN, Basic Info, and V3 Extensions tabs.
2
On Subject DN, enter the distinguished-name values for the root CA. Use your organization’s naming policy.
3
On Basic Info, configure the root key:
  • Set Type to ML-DSA.
  • Set Major key to PMK.
  • Set Size to ML-DSA-44, ML-DSA-65, or ML-DSA-87.
  • Set Usage to Sign/Verify.
  • Set Security Usage to Anonymous Signing.
  • Set Storage to HSM Trusted.
  • Set the signing hash value according to your root CA policy.
  • Set the validity period according to your root CA policy.
4
On V3 Extensions, select the Certificate Authority profile.
The root CA certificate does not need a CRL Distribution Points extension. Windows does not check revocation for a trusted self-signed root. Add the extension only if your PKI policy requires it. You add the extension to the subordinate CA certificate in Configure the ML-DSA subordinate CA.
5
Select OK to start the generation job.
After the job completes, the root CA appears beneath the certificate container with Self-signed in Notes and Valid in Status.

​
Deploy the Microsoft ADCS service

1
Return to the CryptoHub home page and locate Microsoft ADCS in the service store. Select Deploy.
2
On Service Setup:
  • Enter a unique Service Name.
  • Keep or update the Service Category.
Select Next.
3
On Access Control, confirm the authorized resources. Add any additional role or partition that must administer this service, and then select Next.
4
On Service Info, keep the default authentication mechanism and then select Deploy.
The Microsoft ADCS service appears under Deployed Services and reports a successful deployment.

​
Create a client endpoint

1
Open the deployed Microsoft ADCS service, and then select Endpoints.
2
Under Manage Endpoints, select Add New.
3
Configure the endpoint:
  • Enter a unique Endpoint Identifier or leave empty for auto-generation.
  • Keep the auto-populated CryptoHub Hostname.
  • Choose either ECC or RSA for the Client Connection Type.
  • Set Platform to Windows 64-bit.
Select Add Endpoint.
4
Save the downloaded endpoint zip.
The download contains cryptohub-cng.dll, cng-install.exe, cng-uninstall.exe, cng-manager.exe, a pre-filled cryptohub.json, and the TLS files referenced by that configuration.

​
Grant the service access to the certificate container

Give the Microsoft ADCS service role permission to use the certificate container that holds the ML-DSA root CA.
1
In CryptoHub, select PKI & CA > Certificate Management.
2
Right-click the certificate container that holds the ML-DSA root CA, and then select Permission.
3
In the drop-down list next to Add, select Service - SERVICE_NAME, where SERVICE_NAME is the Service Name you entered when you deployed the Microsoft ADCS service. Then select Add.
4
In the new row, set Permission to Use.
5
In the drop-down list below the table, select Apply to selected objects and all children.
6
Select Save.
The permissions table lists the role for the service with Use permission. CryptoHub names this role after the service, for example SERVICE_NAME-Microsoft ADCS-NUMBER.
Continue to Install and configure CryptoHub CNG.