You shouldn't really install the webserver (IIS in your case) on the same server as the CA any more than you should install the CA on a server which provides other services (DCs are a common one).
Instead, stand-up another server for IIS. Better still, stand-up two and load balance them.
Create a share (such as cdp$
) on the IIS (or IISes if that's the correct term) and make sure that this share is writable by members of the CertPublishers
group. This group is automatically created when you install ADCS and populated with all CAs in the forest.
On the ADCS CA's properties dialogue on the Extensions tab, add the path to this share, as well as the variables that create the CRL filename, as a CDP entry. Something similar to:
file:\\iis1.example.com\cdp$\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
and ensure that Publish CRLs to this location is ticked for this entry.
Every time your CA publishes a CRL, it will push a copy to this share. That share needs to be published in IIS and a URL which points to the CRL file published in the certificate issued by this CA.
Therefore, on the same dialogue as before create an entry similar to:
http://iis1.example.com/cdp/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
and ensure Include in the CDP extension of issued certificates is ticked. Note that if you want a more generic name and/or you're using a load-balancer, you can change the hostname element above to anything as long as you configure DNS so that it resolves to the correct server or load-balancer. Maybe something generic, such as pki.example.com
?
So that relying-parties can find the Enterprise Issuing CA certificate when misconfigured servers don't send them, add something similar to the following to the AIA extension on the same tab as above:
http://iis1.example.com/cdp/<CaName><CertificateName>.crt
and ensure Include in the AIA extension of issued certificates is ticked.
You do not need to add a file://
entry for the AIA extension as the CA certificate only changes once every x years, so you can manually upload the Enterprise Issuing CA certificate to IIS.
You also manually upload the CRL from the Root CA to this same IIS server, but you should:
- Have previously added a similar
http
entry to the one above on the Root CA so that the correct URL is embedded in the enterprise issuing CA certificate.
- Ensure that the CA Names differ so that you end up with different filenames (to avoid overwriting CRLs).
You do not need to publish the Root CA certificate in IIS as every relying-party should have this certificate in their trust-anchor store already.
Finally, you should avoid AD/LDAP or any other directory service for publishing CRLs as not all relying parties can access them - stick to HTTP.