Skip to main content

Active Directory Certificate Services

Hosted TokenTimer does not run your CA, and it does not store CA credentials. The Windows agent runs on your network. The private key stays on that host.

Supported builds

AD CS enrollment needs an agent that declares adcs-enroll-v1. The 0.18.0 agent does. Run it on a domain-joined Windows Server member, not on a domain controller. Advanced CA governance and approval-policy administration are outside this hosted scope.

New issuer/profile configuration, preflight and enrollment execution require an active, paid, unfrozen workspace. The worker rechecks admission in the creation transaction. A paused, frozen or downgraded workspace does not discard valid claim-bound results from work already admitted.

Follow the AD CS walkthrough for a concise operator sequence. Preflight uses a real read-only job, even with local dry-run enabled; signed mode: dry_run is not supported for preflight.

What you can do​

Operator action: install the Windows agent on a domain-joined member that can reach the CA. On Pro and Team, open Renewals, then AD CS issuers, then New issuer. Confirm the issuer before New AD CS profile can select it. An unsafe check is not pinned. That issuer stays hidden until Show N unsafe issuers is checked.

Creating an issuer or a renewal profile does not issue a certificate by itself. Follow this order:

  1. Prepare the domain member, CA permissions and server-authentication template using the CA and template prerequisites. The agent authenticates as the member's computer account; do not put a CA administrator password in its configuration.
  2. Verify the agent archive checksum, install it with install-agent.ps1, and confirm Running, registration and a fresh fleet heartbeat. Complete the signed dry run before enabling real execution.
  3. Merge a complete enrollment rule into the existing state configuration: CA config, template common name, dnsScopes and keyAlgorithms. Add the certificate name to declaredTargetSelectors; enable Windows discovery for its store. Preserve agentId, credential and custody files.
  4. Keep execution.enabled: true and local execution.dryRun: true during the real read-only preflight checks, restart the service, and wait for the existing IIS certificate to appear in Certificates. The agent updates an existing binding; it does not create the IIS site.
  5. Create the issuer, run preflight and compare the returned CA key with a certificate obtained independently from your trusted CA administrator before pinning. After you pin the CA certificate, choose Run post-pin check in the setup guide, or Check again on the issuer in Renewals when working outside the guide. The guide dispatches the check on the selected Windows agent and waits for a fresh safe result before continuing; an earlier pre-pin verdict is insufficient. After the safe post-pin check, set local execution.dryRun: false and restart before enrollment. Create an AD CS renewal profile with the DNS name, site, port, SNI, store and approved key algorithm. The form does not select an agent: an eligible agent must declare the target and have passed the issuer check. Choose Attach and enable automation for the discovered certificate.
  6. When the certificate enters the profile's lead time, the maintenance worker creates renewal work. Check the enrollment reaches Installed and the job succeeds, then connect to the actual HTTPS listener with the expected SNI and trusted CA. Confirm its new fingerprint and expiry. A successful preflight alone does not prove installation.

If the CA returns pending approval, follow Pending approval. For a lost submit response, follow Uncertain submission; do not submit a replacement request merely to clear uncertainty.

For a crash or failed installation, use Interrupted enrollment and preserve the agent's journal and key. Hosted TokenTimer operates the control-plane worker; the Compose and Helm worker checks in that runbook apply only to self-hosted installations.

Hosts that are not domain-joined, or that cannot reach the CA over DCOM, keep ACME into a Windows IIS target. The walkthrough is the Windows/IIS worked example.

Enrollment policy and validation deadlines​

API enrollments can freeze optional polling, pending-timeout and validity requirements. The customer host also bounds deferred revocation validation. See Per-enrollment timing and certificate policy and Validation-deferral deadline. These controls retain Cloud plan, workspace, approval and local host-policy checks. Use a package that declares the qualified adcs-enroll-v1 capability.