Building a two-tier PKI: offline root + issuing CA

Posted 12 Jul 2026 · pki, adcs, windows-server

The whole point of two tiers is to keep the root key off the network. The root signs one thing (the issuing CA certificate) and then goes back in the safe. Everything day-to-day is signed by the online issuing CA, which you can revoke and rebuild without touching the root.

1. Standalone offline root

Install the AD CS role on a workgroup machine that never joins the domain. Configure it as a standalone root with a long life and a strong key:

# on the offline root
Install-AdcsCertificationAuthority `
  -CAType StandaloneRootCA `
  -CACommonName "Corp Root CA" `
  -KeyLength 4096 -HashAlgorithm SHA256 `
  -ValidityPeriod Years -ValidityPeriodUnits 20

Set the CDP/AIA in CAPolicy.inf and the registry to an HTTP path before you issue anything, because the root URL is baked into every cert below it and you cannot change it retroactively.

2. Enterprise subordinate (issuing) CA

On a domain-joined server, install AD CS as an enterprise subordinate. It generates a request, you carry it to the root on a USB stick, sign it, and bring back the .p7b:

# issuing CA generates the request during setup, then:
certreq -submit -config "RootPC\Corp Root CA" IssuingCA.req IssuingCA.crt
certutil -installcert IssuingCA.crt
Start-Service certsvc

3. Publish the root into AD

certutil -dspublish -f RootCA.crt RootCA
certutil -pulse   # force clients to pick up the new roots

After that, keep the root powered off and set a calendar reminder to publish a fresh root CRL before it expires. If that CRL lapses, every certificate in the domain fails validation at the same time, and it is not a fun afternoon.