Certificates are everywhere—and when they break, everything breaks. Expired CA certificates, unreachable CRL distribution points, and misconfigured templates are behind some of the most disruptive outages in enterprise IT. Yet most administrators inherit a PKI infrastructure they didn’t build, don’t fully understand, and are afraid to touch.

This full-day hands-on lab changes that. Participants will build a complete two-tier PKI hierarchy from bare metal to production-ready, starting with an offline standalone Root CA and progressing through enterprise subordinate CA installation, AIA/CDP configuration, certificate template design, autoenrollment, key archival and recovery, and OCSP. Every participant leaves having personally constructed, configured, and validated a working enterprise PKI—not just watched slides about one.

The lab environment uses Windows Server with Active Directory Certificate Services in a realistic domain topology. Participants work through the same progression a PKI architect would follow in a real deployment, encountering (and resolving) the same configuration errors, permission issues, and validation failures that occur in production.

You will learn:

• Design and justify a two-tier CA hierarchy with an offline Root CA and online Enterprise Issuing CA
• Install and configure both Standalone and Enterprise CAs with proper capolicy.inf settings
• Configure AIA and CDP extensions correctly—and validate them before issuing any certificates

Attendee Requirements:

• You must provide your own laptop computer (Windows or Mac) for this hands-on lab.
• Current version of Microsoft Edge or Google Chrome must be installed on your machine.

Pre-event Set-up (about 20 minutes of hands-on time, then a few hours of unattended build time):

• Download the attached lab kit and read the README inside.
• Choose one way to host the lab:
  • Option A (recommended, works on any laptop, including Mac): an Azure subscription you control. A new Azure free account (azure.microsoft.com/free) works and includes $200 of credit; the lab uses only a few dollars of it. Sign-up needs a credit card and phone verification, and the free credit lasts 30 days, so you should sign up no earlier than November 1. Anyone who has used a free account before can sign up with a new email address, use a pay-as-you-go, Visual Studio, or company sandbox subscription instead. Please do not use your employer's production subscription.
  • Option B: your own Windows 11 Pro, Enterprise, or Education laptop with the Hyper-V Role installed, 16 GB of RAM, at least 150 GB of free disk, and local admin rights.
• You must run the build scripts before Friday, November 13, and keep the "LAB READY" screenshot b my final check script produces.

What you don't need: any software purchases or product keys (the lab uses Microsoft's free evaluation media), PKI experience, or a production Active Directory.

Download the lab kit here: TMHOL01 Lab Kit

Watch the following video for detailed set up instructions: TMHOL01 Instructional Set Up Video.