- Join the machine to your domain
- Download the CA from Server Manager. AD CS
- Select all options when installing the CA. The web portal & extra features are useful.
- On the domain controller, add a user to the
Cert Publishersgroup in AD Users and Computers - Log into the CA with this user, so they have the necessary permissions.