Microsoft Active Directory Certificate Services (AD CS) provides the server roles to deploy and operate an enterprise public key infrastructure (PKI) for issuing and managing digital certificates. It establishes a trust hierarchy with root and subordinate certificate authorities, which can be configured as offline or integrated with Active Directory. The service uses configurable certificate templates to define the properties and permissions for various certificate types, including those for users, computers, web servers (SSL/TLS), code signing, and smart cards. AD CS supports both automatic enrollment via Group Policy and manual requests, as well as enrollment for non-domain-joined devices through services like the Network Device Enrollment Service (NDES) and web enrollment interfaces. For lifecycle management, it handles certificate revocation by publishing Certificate Revocation Lists (CRLs), provides real-time status checking via an Online Certificate Status Protocol (OCSP) responder, archives private keys for data recovery, and maintains a database for auditing certificate history.
