Skip to main content

Microsoft AD CS to IIS: first renewal

On eligible Pro/Team workspaces, connect an existing Microsoft CA and renew a certificate on an existing IIS binding. This procedure does not create an Active Directory domain, CA, template or IIS site.

Watch on YouTubeWatch the full series

The video shows self-hosted TokenTimer. Cloud 0.18 uses the shared setup guide with hosted plan and delivery rules; follow the Cloud-specific steps below.

Prepare the member and template​

Use a workspace administrator for issuer confirmation and profile creation.

Use a supported domain-joined Windows Server member, with a connected agent declaring adcs-enroll-v1. The agent runs as LocalSystem and authenticates as the computer account. The CA/template must be published and satisfy the AD CS safety rules. Give the intended computer identity, or its dedicated group, Read and Enroll on that template.

Keep the existing IIS site, HTTPS port/SNI and machine Personal store ready. Enable discovery and wait for the actual IIS certificate to appear in inventory. Its DNS name must also be declared by the agent. Complete the signed no-op smoke check before this workflow; preserve the enrolled identity when merging the generated AD CS rule.

Check and pin the CA​

  1. In the Cloud setup guide, choose Issue certificates from my Microsoft CA (AD CS) and Windows Server. Select your existing domain-joined agent where appropriate.
  2. Save the local rule with the exact CA config, template name, approved DNS scope and key algorithms; restart only TokenTimerAgent. Keep local execution.enabled: true and execution.dryRun: true during the read-only CA checks.
  3. Add the issuer and run the check on the same agent that will enroll. Both CA and template verdicts must be safe.
  4. Independently obtain the CA certificate from its trusted administration channel. Compare it with the certificate reported by the check before Use this certificate. A newest-certificate suggestion is not an independent trust decision; do not pin on that basis alone.
  5. Choose Run post-pin check in the guide to dispatch a fresh read-only CA/template check on that same Windows agent. Wait for Post-pin CA and template checks passed before creating the profile. An earlier safe result does not satisfy this check. If reading the result fails, use Refresh check result to retry the read without dispatching another job. The manual Renewals → issuer → Check again action remains available outside the guide.

Local enrollment rules​

The agent's local rule restricts enrollment to the approved CA config, template, DNS scope and key algorithms. Keep these values aligned with the issuer and renewal profile; saving a profile does not expand the host's allowlist.

AD CS preflight is a real read-only job, not a signed mode: dry_run job. With execution enabled, the 0.18 agent handles it separately from the local dry-run refusal for enrollment. A signed preflight in dry-run mode is rejected; use the install runbook's signed no-op test for transport. After the pin/recheck is safe, deliberately change local execution.dryRun to false and restart before enrollment. Configuration maintenance covers access errors.

Create and attach the profile​

Create New AD CS profile with the pinned issuer, DNS name, existing IIS site/port/SNI, store and supported key parameters. Set the renewal lead time. The form does not select an agent; an eligible connected agent must already declare the name and have passed the issuer check.

For an existing certificate, compare the observed IIS binding, expiry and public identity before attaching. A stored copy with the same name is not necessarily the live registration. Use Attach and enable automation when the correct registration is offered. Otherwise open that exact certificate's Certificate management controls to select the profile; preserve ended management-period history. Do not attach a different row just to advance the guide.

When the certificate is due and eligibility/approval conditions are met, the worker creates renewal work. Creating a profile or finishing the guide does not itself prove enrollment.

Verify the result​

Inspect the new job's timeline and read-only Agent output. For immediate issuance, confirm installation in the machine Personal store and IIS rebinding. If the CA holds the request, follow Pending approval; do not resubmit to clear a pending or uncertain state.

Use native IIS and independent TLS checks to prove that the new certificate is actually served. Then return to the same certificate/profile to review its next renewal window and history. Alert recipients are separate from verified email delivery.