Skip to main content
This section provides examples of viewing the Windows Certificate Store and signing a certificate by using AD CS on the KMES.

​
View the Certificate Store

Use the following command to view the CA certificate store. The LDAP URI depends on the Active Directory domain for your organization (such as fx.futurex.com) and the CA name (such as fx-FXCA).
Powershell
certutil -viewstore "ldap:///CN=fx-FXCA,CN=Certification Authorities,
CN=Public Key Services,CN=Services,CN=Configuration,DC=fx,
DC=futurex,DC=com?cACertificate?base?objectClass=certificationAuthority"
Between tests you might choose to clear the certificate store by using a command similar to the following:
Powershell
certutil -delstore "ldap:///CN=fx-FXCA,CN=Certification Authorities,
CN=Public Key Services,CN=Services,CN=Configuration,DC=fx,
DC=futurex,DC=com?cACertificate?base?objectClass=certificationAuthority" fx-FXCA

​
Sign a certificate

The following steps demonstrate one way to test by using the KMES Series 3 to sign a certificate for the CA server.
1
Open the Certificate Manager on the CA server.
2
Right-click Personal and select All Tasks > Request New Certificate.
3
In the Certificate Enrollment window, select [ Next ].
4
In the Certificate Enrollment Policy window, choose a certificate enrollment service associated with the CA server, such as Active Directory Enrollment Policy for an Enterprise CA. Select [ Next ].
5
In the Request Certificates window, choose a certificate template and select [ Enroll ].
If the connection to the KMES succeeds, you receive a success message. If the KMES is offline you receive an error.
6
To locate the certificate that you issued, perform the following steps:
  1. Open the Active Directory Certificate Authority tool from the Server Manager.
  2. Expand the node associated with your CA common name.
  3. Select [ Issued Certificates ].
A certificate matching your request displays on this page.