With Microsoft AD CS
Microsoft AD CS (Active Directory Certificate Services) lets you issue internal certificates via an on-premises Enterprise CA. Communication between the CLM and the CA happens through an agent installed on the internal network.
Prerequisites
- Access with ADMIN or OPERATOR role
- A CLM agent installed on a Windows server with access to the AD CS server
- The necessary permissions configured on the CA and on the templates
See the [Install the On-Premises Agent](/en/guias/agente/visao-geral) guide for the complete installation requirements, service account permissions, and network configuration.
Required permissions on AD CS
The agent's service account needs the following permissions:
On the CA server (certsrv):
| Permission | Purpose |
|---|---|
| Request Certificates | Submit CSRs via certreq |
| Read | List and download issued certificates |
On the certificate templates:
| Permission | Purpose |
|---|---|
| Enroll | Issue certificates with the template |
| Read | List available templates |
If the template requires CA Manager approval, the CLM will stay in **pending_approval** status until the administrator approves it in the AD CS console. For full automation, use templates with automatic approval.
Step 1 — Install the Windows agent
The CLM agent needs to be installed and online on a Windows server with access to the AD CS server.
→ Follow the Install the On-Premises Agent — Windows guide
After installation, confirm that the agent appears with Online status under Agents in the sidebar menu before continuing.
Step 2 — Configure the AD CS integration
- Go to Integrations in the sidebar menu
- Find the ADCS card and click + Configure
- Fill in the fields:
- Integration Name — e.g.:
adcs-production - Windows Agent — select the agent installed in Step 1
- CA Server FQDN — hostname or IP of the AD CS server, e.g.:
WIN-9DTEAAV79IJ.lab2.com
- Integration Name — e.g.:
- Click Save changes
After saving, click Refresh templates to load the certificate templates published on the CA. This needs to be done whenever new templates are published on AD CS.
Step 3 — CSR Step 2: CA and Configuration
- Under Certificate Authority, select Microsoft AD CS (Enterprise CA with agent)
- Fill in the fields:
| Field | Description |
|---|---|
| Certificate Authority | Select the AD CS integration registered in Step 2 |
| Certificate Template | Select the template to be used for issuance |
| Organization (O) | Legal name of the organization (required) |
| Organizational Unit (OU) | Department or division (optional) |
| City/Locality (L) | City (required) |
| State/Province (ST) | State or province (required) |
| Country (C) | 2-letter country code, e.g.: BR (required) |
| Notes | Optional notes |
Step 4 — Certificate issuance
After submitting the request, the CLM sends the CSR to the Windows agent, which forwards the request to the AD CS server via certreq.
If the template is configured with automatic approval, the certificate is issued immediately and the status changes to Issued. Click View Certificate to access it under Certificates.
If the template requires manual approval, the status will remain pending_approval until the administrator approves the request in the AD CS console.