--- title: "Publish the Root and Issuing CA Certificates" slug: "int-microsoft-ad-root" updated: 2023-05-05T20:05:30Z published: 2023-05-05T20:05:30Z canonical: "docs.axiad.com/int-microsoft-ad-root" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.axiad.com/llms.txt > Use this file to discover all available pages before exploring further. # Publish the Root and Issuing CA Certificates The Axiad ID Cloud environment includes a Public Key Infrastructure. As part of the creation of the environment a root CA certificate and an issuing CA certificate are generated. These files typically are named in the format: - _Cloud_PKI_Root_CA.crt - _Cloud_PKI_Issuing_CA_Users.crt WARNINGThese two files must be published in your Microsoft Active Directory so every machine joined to the domain will trust them. This is a requirement for PKI login. The easiest way is to publish the certificates in the suitable stores: - **AIA**: Contains CA certificates that can be retrieved by clients using the authority information access (AIA) certificate extension to build a valid certificate chain and to retrieve any cross-certificates issued by the CA. Certificates published to this container will be published into the Intermediate Certification Authorities store on domain joined computers. - **Certification Authorities**: This container is used to store trusted root certificates. This container may contain entries of certificateAuthority type. CA certificates are written to CACertificate attribute. All certificates from this container are propagated to each client as a part of group policy processing to client’s Trusted Root Certification Authorities container. - **NTAuthCertificates**: This entry is used to store certificates for CAs that are eligible to issue smart card logon certificates. During smart card logon, domain controller checks whether issuer is presented in the NTAuthCertificates entry. If it doesn’t, the logon attempt is denied immediately. All certificates from this container are propagated to each client as a part of group policy processing to client’s Intermediate Certification Authorities container. The following screenshot shows the Active Directory stores where the Axiad ID Cloud certificates are published: ![ad_stores](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/ad_stores.png) ## Commands to Publish Root and Issuing CA Certificates The publication is performed via the three commands below. The configuration is then replicated between the Domain Controllers and then to every machine on the domain. NOTEThe commands below must be run with an Enterprise Admin account on the domain so the certificates can be pushed to the correct store. They do not need to be run from a Domain Controller.WARNINGIf computer auto-enrollment is disabled, the CA certs will not publish. Open the Group Policy Management Editor and ensure that **Computer Configuration > Policies> Windows Settings > Security Settings > Public Key Policies >Certificates Services Client – Auto-Enrollment policy** is set to **Not configured** or **Enabled**. ![publish_warning](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/publish_warning.png)If desired, this GPO may be disabled once the CA certificates have been published. 1. ```custom certutil -f -dspublish _Cloud_PKI_Root_CA.crt ``` **Output:****![aia_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/aia_output.png)** 2. ```custom certutil -f -dspublish _Cloud_PKI_Issuing_CA_Users.crt SubCA ``` **Output:****![cert_authorities_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/cert_authorities_output.png)** 3. ```custom certutil -f -dspublish _Cloud_PKI_Issuing_CA_Users.crt NTAuthCA ``` **Output:****![1ntauth_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/1ntauth_output.png)** Once the certificates are published, you must wait for the replication to happen between DC’s and also with the various machines joined to the domain. You may force the update with the command below. NOTEThe command must run as a local administrator. ```custom gpupdate /force ``` **Output:**![2ntauth_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/2ntauth_output.png) ## Commands to Verify Publication It is important to verify that the publication of the certificates performed in the previous section has been successful. The following commands display the certificates in every store. The best way to validate that is to run the following set of commands to open a pop-up that lists what is present in each corresponding store. You may have to click **"More choices"** to display the full list.![verify](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/verify.png) ```custom certutil -viewstore -enterprise root ``` **Output:**![1verify_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/1verify_output.png) ```custom certutil -viewstore -enterprise ca ``` **Output:**![2verify_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/2verify_output.png) Command:Command: ```custom certutil -viewstore -enterprise ntauth ``` **Output:**![3verify_output](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/3verify_output.png)