Public Key Infrastructure (PKI) Complete Course

Explore PKI structure, including certificate authorities and key management, and compare symmetric and asymmetric encryption, including public/private keys and digital signing processes.

Identify and protect the algorithm and key as the core of encryption, enabling secure bidirectional transformation of plain-text to ciphertext with one-time keys and secure key distribution.

Explore symmetric encryption's use of an identical key for encryption and decryption, safeguarding data from unauthorized access and enabling fast bulk data processing and ciphertext transmission between Alice and Bob.

Explore symmetric encryption methods, including DES, DES-X, RC4, RC2, triple DES, AES, and ChaCha20, and distinguish block ciphers from stream ciphers for secure data protection.

Explore the speed and efficiency of symmetric encryption for high-throughput data processing and storage protection in embedded systems and IoT. Understand secure key distribution and TLS/VPN applications.

Asymmetric encryption uses a public key and a private key to secure messages, while a hybrid approach encrypts data with symmetric encryption and protects the key with the public key.

Examine how the originator's private key encrypts data to ciphertext, and how the recipient uses the public key to decrypt it and verify origin and data integrity.

Explore Diffie-Hellman key agreement to establish a shared secret for secure PKI-enabled communication, then RSA encryption and signing via public and private keys.

Demonstrates hybrid encryption in an enterprise using symmetric and asymmetric methods. Shows how Active Directory retrieves public keys and protects symmetric keys with the public key.

Install Windows Server 2022 and complete post-install steps, including activation and configuring network and remoting. Prepare a base image with sysprep for the PKI lab.

Explore installing Windows Server 2022 from boot media, selecting core or desktop. Configure language, product key, administrator password, and server manager settings for secure operation.

Activate Windows Server 2022 after installation using internet or phone, with SLUI and slmgr.vbs commands to manage product keys, view editions, and perform remote or core-server activation.

Perform essential post-install tasks for Windows Server 2022, including hardware checks with device manager and msinfo32, systeminfo basics, network testing, enabling Windows updates, and language pack installation.

Master post-install tasks by renaming servers, joining domains, and enabling remote desktop, using GUI or core methods, with DNS setup and logon policy controls.

Learn how to create a base image with sysprep, including OOBE and generalize, after post-install changes, and capture a vm-ready vhdx for rapid new server deployment.

Recap the lab: clone a repo, boot a Windows 2022 VM, use PowerShell, and run slui, slmgr, dism, devmgmt, msinfo32, systeminfo, lcpa, lpk setup, and domain controller prep.

deploy multiple domain controllers in a vlab8.com active directory domain using server manager and powershell; promote the first domain controller to a forest root with ad ds and dns integration.

Join a Windows client to the vlapse8.com domain, install rset tools and Windows Admin Center, and establish centralized domain management with a self-signed certificate before deploying production SSL.

Add a core server to the VLAPS8.com domain, configure domain controller rules via Windows Admin Center, and create a new child domain DC2 with a PowerShell one-liner.

Using PowerShell, add a child domain lab1 under vlab8.com by installing AD DS, DNS delegation, and DC provisioning, then consolidate domain controllers in Windows Administration Center.

Create a Windows server lab with PowerShell by cloning a repository, provisioning four VMs in Hyper-V, configuring AD DS and a child domain, and joining a client with checkpoints.

Explore Active Directory administration tools, including the Active Directory Administrative Center and PowerShell, to manage domain controllers and users across domains via snap-ins such as Sites and Services.

Build a PKI lab with Hyper-V and a Sysprep base image, using differencing VHDX files and multiple VMs to deploy a domain with AD DS and offline root CA.

Configure offline root CA on casvr1, prepare ca-policy.inf, install the standalone root CA, and export the root certificate and CRL to removable media.

Configure root CA settings by adjusting CRL distribution points and AIA extensions in Server Manager, then use PowerShell and CertUtil to set CRL intervals, validity, and restart the CA service.

Install and configure the IIS web server and management service on CA SVR2 using PowerShell, import the root CA certificate, and set up the DNS zone and pointer for pki.learnedlessons.com.

Configure an iis pki setup by creating a pki folder, setting permissions for sort publishers group, sharing it, and adding a directory with browsing and double escaping for delta crl.

Set up an enterprise subordinate CA on a dual-role server, create ca-policy.inf, install AD CS, issue and submit a certificate with certutil, and complete the offline root CA workflow.

Configure CRL distribution point and Authority Information Access on subordinate CA (CA-SVR2) by clearing and adding distribution point URIs, updating AIA, and verifying settings with PowerShell and sortutil.

Build a PKI and Windows certificate authority lab using Windows server core, Hyper-V on a Windows 11 host, and PowerShell direct to issue certificates across three VMs in a domain.

Build and configure an offline root certificate authority on Windows Server core VMs, install AD CS, publish CRL, install IIS web management, join the domain, and set up DNS.

Build a practical PKI lab on Windows Server core VMs by configuring a PKI folder, an IIS virtual directory, and an enterprise subordinate CA for certificate issuance.

Explore enterprise CA advantages over stand-alone CA, including auto-enrollment, certificate templates, and policy-based approvals, and understand when to deploy subordinate CAs for segmenting certificate issuance and high availability.

Explore how AD CS enables PKI by issuing certificates to secure data, supporting confidentiality, integrity, authenticity, non-repudiation, and a root-subordinate CA hierarchy with TPM attestation.

Explore options for designing PKI with CA hierarchies, from a two-tier root and subordinate CA to policy CAs and cross-certification, and decide when to deploy offline roots or external certificates.

Compare standalone and enterprise CAs in Windows Server 2016 AD-DS, highlighting AD-DS dependency, auto enrollment, and distinct certificate request and issuance methods for offline versus online use.

Plan root CA deployment by weighing offline vs online, standalone vs enterprise, selecting CSP, key length, and hash, and publish CDP, AIA, and CRLs via group policy.

Deploy a subordinate CA to enforce policy restrictions and issue certificates to ADDS users and computers, publishing them to ADDS, with an offline root CA and an enterprise subordinate CA.

Use the CAPolicy.inf file to configure root or subordinate CA installations, define a certification practice statement and CRL publication intervals, and copy the file to the system root before ADCS.

Administer and manage a CA hierarchy with ADCS, configure CA security and policies, set CDP and AIA locations, and define CA administration roles and permissions.

Manage your SCA deployment with PowerShell cmdlets, CertUtil, and Group Policy, configuring security, logging, certificate templates, CDP/AIA/OCSP URIs, auto-enrollment, and certificate distribution.

Configure CA security in PKI by managing permissions for certificate issuance, reading, and export, delegating certificate management on templates, and controlling access with ACLs in AD DS and certificate properties.

Explore how ADCS uses role-based administration to delegate permissions to groups for enterprise and stand-alone CAs, covering roles like CA administrator, certificate manager, backup operator, and auditor.

Explore configuring CA policy and exit modules within PKI, defining actions after certificate requests, enabling suppression or issuance, and integrating MIM 2016 workflows and SQL server logging.

Configure AIA and CDP certificates for each CA to improve PKI trust, revocation checks, and interoperability across internal and external clients.

Demonstrates configuring CA properties in the Certification Authority console, including opening the CA, accessing properties, adjusting general and access settings, and applying certificate template restrictions.

Explore maintenance and preservation of CA hierarchies in active directory certificate services, including tools for managing auto enrollment, publishing templates, and PKI-View insights for CA health and AIA/CDP status.

Troubleshoot ADCS with built-in tools like certificate snap-in, pki-view.msc, CA console, sortutil.exe, templates snap-in, and PowerShell; diagnose auto-enrollment and template permissions.

Learn how to renew a CA certificate in PKI by managing root and subordinate CA validity, using 4096-bit keys, renewing before expiration, and applying CRL management and renewal procedures.

Learn how to move a root certificate authority to new hardware, by performing a CA backup and restore, preserving the same identity, keys, and templates across servers.

Access the PKI View Console in Windows Server 2016 to monitor CA health and AIA, CDP, OCSP locations. Configure CA auditing to log backups, configuration changes, and certificate requests.

Deploy and manage a two-tier PKI with AD CS on Windows Server 2016, configuring offline root and enterprise subordinate CAs, CDP and AIA locations, DNS records, and CRL publishing.

Deploy and manage a two-tier PKI with AD CS on Windows Server 2016, including offline root CA setup, enterprise subordinate CA, certificate services configuration, and publishing CRL and AIA/CDP locations.

Learn to deploy and manage certificate templates, enrollment, and revocation in business environments. Explore backup, recovery, and smart card deployment to secure PKI operations.

Learn to manage certificate templates on the CA and Active Directory Domain Services, including user and computer templates, permissions, enrollment, and auto-enrollment, plus updating and superseding templates.

Explore certificates as small files with owner data and a public-private key pair, including AIA and CDP references. Learn how certificate templates streamline usage and forest-wide replication in AD DS.

Explore the four versions of certificate templates in Windows Server Certificate Services, from Version 1 basic permissions to Version 4 with auto-enrollment, CNG, and key renewal.

Configure certificate template permissions in ADDS by assigning full control, read, write, and auto-enroll to manage who can read, modify, or enroll certificates, following best practices.

Configure certificate templates across versions to set security, key lengths, validity, enrollment, and purposes, choosing single- or multi-purpose templates for users, computers, and smart card sign-in.

Explore how to update PKI certificate templates by modifying existing templates or superseding them, including merging templates and ensuring issued certificates reflect new settings.

Demonstrates modifying and enabling certificate templates in a certificate authority, duplicating templates, adjusting security permissions, and adding user-request templates for IPsec deployment.

Explore how to deploy PKI in your organization, covering certificate distribution and enrollment, revocation and CRL management, and key archival and recovery with auto-enrollment and enrollment agents.

Explore Windows Server 2016 certificate enrollment methods—auto-enrollment for mass deployment and certificate templates via group policy, manual enrollment, CA web enrollment, and auto-enrollment on behalf.

Auto-enrollment automates distribution of certificates to domain users and computers using enterprise CAs, requiring template permissions and domain policy, with roaming credentials and periodic 8-hour checks.

Explore how Windows Server 2016 CE uses enrollment agents to enroll certificates for others, enforce scope via security groups and templates, and secure or minimize enrollment agents.

Learn how certificate revocation disables certificates and how CRLs and OCSP verify revocation status across a PKI, including CryptoAPI phases from discovery to network retrieval.

Learn how to archive and recover private keys within PKI by configuring a KRA and enabling key archival on certificate templates, enabling data recovery for encrypted data.

Configure a certificate authority for key archival by enabling the key recovery agent template, archiving keys, and validating the key recovery agent certificate via CA console and PowerShell.

Explore how ssl uses certificates and a handshake to establish a secure encrypted link between client and server, relying on a trusted ca store and subject alternative names.

Learn how certificates enable digital signatures to protect content and verify the author's identity, with a hash digest signed by a private key and verified by a public key.

Learn how certificates enable content encryption with a hybrid approach in EFS and email encryption, using a symmetric file key and the public key to protect and recover data.

Explore digitally signing a Word document using a user certificate and signature line, then encrypt a file with EFS to protect contents on Windows.

Configure a Windows Server 2016 ADCS PKI by creating web server and user templates, enabling auto-enrollment, smart card enrollment, Microsoft Office document signing, and key recovery with a KRA.

Deploy, issue, and use certificates with ADCS on Windows Server 2016, covering web server and user templates, auto-enrollment, enrollment policy, and key archival workflows.

Coordinate certificate management across five forests by recognizing that each forest's CA operates independently, requiring manual maintenance of certificate templates, enrollment policies, and revocation for terminated users.