According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that problem is this: During the generation the large prime factors used by the RSA algorithm, a significant number of devices ended up choosing the same prime factors. Presumably this occurred because insufficient entropy was used by the devices to select the prime factors.
When you install Active Directory Certificate Services, you are presented with the following screen:
Ostensibly, completing the installation causes the generation of the prime factors that comprise the key pair.
I have often heard the recommendation (here's one) to create your root certificate authority as a virtual machine to ease taking it offline and physically securing it. In a Windows Environment, it seems natural to host your root CA using Hyper-V.
This then raises the following questions:
Where does a HyperV-hosted instance of Windows Server get its entropy when generating the prime factors during AD Certificate Services installation?
How 'good' is the entropy source?