Microsoft AD CS to IIS: first renewal

Connect an existing Microsoft CA and renew a certificate on an existing IIS binding. This procedure does not create an Active Directory domain, CA, template or IIS site.

Watch on YouTube · Watch the full series

Prepare the member and template

Use a workspace administrator for issuer confirmation and profile creation.

Use a supported domain-joined Windows Server member, with a connected agent declaring adcs-enroll-v1. The agent runs as LocalSystem and authenticates as the computer account. The CA/template must be published and satisfy the AD CS safety rules. Give the intended computer identity, or its dedicated group, Read and Enroll on that template.

Keep the existing IIS site, HTTPS port/SNI and machine Personal store ready. Enable discovery and wait for the actual IIS certificate to appear in inventory. Its DNS name must also be declared by the agent. Complete the signed no-op smoke check before this workflow; preserve the enrolled identity when merging the generated AD CS rule.

Check and pin the CA

1. In the setup guide, choose Issue certificates from my Microsoft CA (AD CS) and Windows Server. Use the existing-agent choice where appropriate.
2. Save the local rule with the exact CA config, template name, approved DNS scope and key algorithms; restart only TokenTimerAgent. Keep local execution.enabled: true and execution.dryRun: true during the read-only CA checks.
3. Add the issuer and run the check on the same agent that will enroll. Both CA and template verdicts must be safe.
4. Independently obtain the CA certificate from its trusted administration channel. Compare it with the certificate reported by the check before Use this certificate. A newest-certificate suggestion is not an independent trust decision; do not pin on that basis alone.
5. Run a fresh check after pinning on that same agent. The current guide links to Renewals → issuer → Check again for this; return to the saved guide afterward. The guide's summary-refresh button does not dispatch the CA check.

AD CS preflight is a real read-only job, not a signed mode: dry_run job. With execution enabled, the 0.18 agent handles it separately from the local dry-run refusal for enrollment. A signed preflight in dry-run mode is rejected; use the install runbook's signed no-op smoke test for transport. After the pin/recheck is safe, deliberately change local execution.dryRun to false and restart before enrollment. Configuration maintenance covers access errors.

Create and attach the profile

Create New AD CS profile with the pinned issuer, DNS name, existing IIS site/port/SNI, store and supported key parameters. Set the renewal lead time. The form does not select an agent; an eligible connected agent must already declare the name and have passed the issuer check.

For an existing certificate, compare the observed IIS binding, expiry and public identity before attaching. A stored copy with the same name is not necessarily the live registration. Use Attach and enable automation when the correct registration is offered. Otherwise open that exact certificate's Certificate management controls to select the profile; preserve ended management-period history. Do not attach a different row just to advance the guide.

When the certificate is due and eligibility/approval conditions are met, the worker creates renewal work. Creating a profile or finishing the guide does not itself prove enrollment.

Verify the result

Inspect the new job's timeline and read-only Agent output. For immediate issuance, confirm installation in the machine Personal store and IIS rebinding. If the CA holds the request, follow Pending approval; do not resubmit to clear a pending or uncertain state.

Use native IIS and independent TLS checks to prove that the new certificate is actually served. Then return to the same certificate/profile to review its next renewal window and history. Alert recipients are separate from verified email delivery.