Public Key Infrastructure (PKI) Complete Course

Explore PKI structure, including certificate authorities and key management, and compare symmetric and asymmetric encryption, including public/private keys and digital signing processes.

Identify and implement core encryption components by selecting robust algorithms, managing one-time keys per session, and securely distributing keys to protect plain-text and ciphertext in PKI-enabled apps.

Learn how symmetric encryption uses an identical key for encryption and decryption, enabling fast bulk processing of large data; a randomly generated key converts plain text to ciphertext for transmission.

Explore symmetric encryption methods, including DES, DES-X, RC4, RC2, triple DES, AES, and ChaCha20, and distinguish block ciphers from stream ciphers for secure data protection.

Explore how symmetric encryption delivers superior speed and resource efficiency for data storage and real-time, high-throughput applications, including embedded systems, while examining secure key distribution and vulnerabilities.

Asymmetric encryption uses a public key and a private key to secure messages, while a hybrid approach encrypts data with symmetric encryption and protects the key with the public key.

Examine how the originator's private key encrypts data to ciphertext, and how the recipient uses the public key to decrypt it and verify origin and data integrity.

Explore key asymmetric algorithms in PKI, including Diffie-Hellman key agreement for deriving a shared secret and RSA for encryption and signing with longer key lengths affecting security and speed.

Combine symmetric and asymmetric encryption for efficient data protection in an enterprise environment using Active Directory. Retrieve public keys from digital certificates to secure key exchange.

Install Windows Server 2022 and complete post-install steps, including activation and configuring network and remoting. Prepare a base image with sysprep for the PKI lab.

Install Windows Server 2022 by booting from boot media, choosing core or desktop installation, configuring language, key, partitions, drivers, and finalizing with administrator password and Server Manager setup.

Activate Windows Server 2022 after installation using internet or phone, with SLUI and slmgr.vbs commands to manage product keys, view editions, and perform remote or core-server activation.

Perform essential post-install tasks for Windows Server 2022, including hardware checks with device manager and msinfo32, systeminfo basics, network testing, enabling Windows updates, and language pack installation.

Master post-install tasks by renaming servers, joining domains, and enabling remote desktop, using GUI or core methods, with DNS setup and logon policy controls.

Learn how to create a base image with sysprep, including OOBE and generalize, after post-install changes, and capture a vm-ready vhdx for rapid new server deployment.

Recap the hands-on exercise with git clone on a Windows 2022 VM, then use PowerShell to run commands like slui, slmgr, dism, and systeminfo to activate the server.

Deploy multiple domain controllers for vlab8.com using Server Manager and PowerShell. Promote the first domain controller with AD DS, DNS, and a new forest via InstallADDSForest.

Join a Windows client to the vlabs8.com domain after DC1 comes back. Then install RSAT tools and Windows Admin Center on the client to centrally administer Active Directory domain services.

Add a core server to the vlaps8 domain, install Active Directory Domain Services, and create a child domain DC2 via a PowerShell one-liner, configuring DNS and Windows Admin Center deployment.

Add a child domain lab1.vlabs8.com with PowerShell to install AD DS, enable DNS delegation, and provision domain controllers.

Create a Windows server lab with PowerShell by cloning a repository, provisioning four VMs in Hyper-V, configuring AD DS and a child domain, and joining a client with checkpoints.

Explore Active Directory administration tools, including the Active Directory Administrative Center and PowerShell, to manage domain controllers and users across domains via snap-ins such as Sites and Services.

Build a PKI lab with Hyper-V and a Sysprep base image, using differencing VHDX files and multiple VMs to deploy a domain with AD DS and offline root CA.

Configure offline root CA on casvr1, prepare ca-policy.inf, install the standalone root CA, and export the root certificate and CRL to removable media.

Configure root CA settings by adjusting CRL distribution points and AIA extensions in Server Manager, then use PowerShell and CertUtil to set CRL intervals, validity, and restart the CA service.

Install and configure the IIS web server and management service on CA SVR2 using PowerShell, import the root CA certificate, and set up the DNS zone and pointer for pki.learnedlessons.com.

Configure an iis pki setup by creating a pki folder, setting permissions for sort publishers group, sharing it, and adding a directory with browsing and double escaping for delta crl.

Set up an enterprise subordinate CA on the server, install active directory certificate services, configure CAPolicy.in, generate a 1496-bit key, and handle offline root CA certificate requests with certutil.

Configure CRL distribution point and Authority Information Access on subordinate CA (CA-SVR2) by clearing and adding distribution point URIs, updating AIA, and verifying settings with PowerShell and sortutil.

Build a PKI and Windows certificate authority lab using Windows server core, Hyper-V on a Windows 11 host, and PowerShell direct to issue certificates across three VMs in a domain.

Build and configure an offline root certificate authority on Windows Server core VMs, install AD CS, publish CRL, install IIS web management, join the domain, and set up DNS.

Build a practical PKI lab on Windows Server core VMs by configuring a PKI folder, an IIS virtual directory, and an enterprise subordinate CA for certificate issuance.

Explore enterprise CA advantages over stand-alone CA, including auto-enrollment, certificate templates, and policy-based approvals, and understand when to deploy subordinate CAs for segmenting certificate issuance and high availability.

Explore how AD CS enables PKI by issuing certificates to secure data, supporting confidentiality, integrity, authenticity, non-repudiation, and a root-subordinate CA hierarchy with TPM attestation.

Design your CA hierarchy by defining root and subordinate roles, choosing single or multi-level deployments, and establishing policy CAs or cross-certification to meet issuing policies.

Compare standalone and enterprise CAs in Windows Server 2016 AD-DS, highlighting AD-DS dependency, auto enrollment, and distinct certificate request and issuance methods for offline versus online use.

Decide on offline vs online root CA and choose between enterprise or stand-alone hierarchies, then configure cryptographic provider, key length, and hash, while planning CDP/AIA, CRL publishing, and offline security.

Deploy a subordinate CA to enforce policy restrictions and issue certificates to ADDS users and computers, publishing them to ADDS, with an offline root CA and an enterprise subordinate CA.

Use the CAPolicy.inf file to configure root or subordinate CA installations, define a certification practice statement and CRL publication intervals, and copy the file to the system root before ADCS.

Administer and manage a CA hierarchy with ADCS, configure CA security and policies, set CDP and AIA locations, and define CA administration roles and permissions.

Manage your SCA deployment with PowerShell cmdlets, CertUtil, and Group Policy, configuring security, logging, certificate templates, CDP/AIA/OCSP URIs, auto-enrollment, and certificate distribution.

Configure CA security in PKI by managing permissions for certificate issuance, reading, and export, delegating certificate management on templates, and controlling access with ACLs in AD DS and certificate properties.

Explore how ADCS uses role-based administration to delegate permissions to groups for enterprise and stand-alone CAs, covering roles like CA administrator, certificate manager, backup operator, and auditor.

Explore configuring CA policy and exit modules within PKI, defining actions after certificate requests, enabling suppression or issuance, and integrating MIM 2016 workflows and SQL server logging.

Configure AIA and CDP certificates for each CA to improve PKI trust, revocation checks, and interoperability across internal and external clients.

Demonstrates configuring CA properties in the Certification Authority console, including opening the CA, accessing properties, adjusting general and access settings, and applying certificate template restrictions.

Use built-in ADCS tools, including certificate snap-in, PKI view.msc, CA console, SortUtil.exe, certificate template snap-in, and PowerShell, to monitor, configure, and troubleshoot auto-enrollment and enterprise CE publishing.

Learn how to renew a CA certificate before expiration, including root vs subordinate CAs, 4096-bit keys, and optimal validity periods. Manage CRLs and renewal via the Certification Authority Console.

Move a root CA to another computer by backing it up and restoring it. Preserve the CA's identity and follow backup and restore steps, including private key and certificate database.

Access the PKI View Console in Windows Server 2016 to monitor CA health and AIA, CDP, OCSP locations. Configure CA auditing to log backups, configuration changes, and certificate requests.

Configure and deploy AD CS on Windows Server 2016, create and issue certificate templates, enable auto-enrollment and enrollment agents, and enable smart card sign-in and key recovery.

Deploy and manage a two-tier PKI with AD CS on Windows Server 2016, including offline root CA setup, enterprise subordinate CA, certificate services configuration, and publishing CRL and AIA/CDP locations.

Discover how to deploy and manage certificates across a public key infrastructure, configure certificate templates, and implement backup, recovery, and revocation strategies for business environments and smart cards.

Explore certificate templates in AD CS, learn how to manage user and computer templates, enable auto-enrollment, and update or supersede templates across Windows Server environments.

Explore certificates as small files with owner data and a public-private key pair, including AIA and CDP references. Learn how certificate templates streamline usage and forest-wide replication in AD DS.

Explore the four versions of certificate templates in Windows Server Certificate Services, from Version 1 basic permissions to Version 4 with auto-enrollment, CNG, and key renewal.

Configure certificate template permissions in ADDS by assigning full control, read, write, and auto-enroll to manage who can read, modify, or enroll certificates, following best practices.

Configure certificate templates across versions to set security, key lengths, validity, enrollment, and purposes, choosing single- or multi-purpose templates for users, computers, and smart card sign-in.

Explore managing certificate templates in a PKI system by modifying or superseding templates, merging templates into one, and applying changes via the Certificate Templates console to impact issued certificates.

Demonstrates modifying and enabling certificate templates in a certificate authority, duplicating templates, adjusting security permissions, and adding user-request templates for IPsec deployment.

Explore how to deploy PKI in your organization, covering certificate distribution and enrollment, revocation and CRL management, and key archival and recovery with auto-enrollment and enrollment agents.

Explore Windows Server 2016 certificate enrollment methods—auto-enrollment for mass deployment and certificate templates via group policy, manual enrollment, CA web enrollment, and auto-enrollment on behalf.

Auto-enrollment automates distribution of certificates to domain users and computers using enterprise CAs, requiring template permissions and domain policy, with roaming credentials and periodic 8-hour checks.

Explore how Windows Server 2016 CE uses enrollment agents to enroll certificates for others, enforce scope via security groups and templates, and secure or minimize enrollment agents.

Explore how certificate revocation works, from revoking certificates and publishing CRLs to OCSP-based online responders, and how CryptoAPI conducts discovery, path validation, revocation checks, and caching.

Learn how to archive and recover private keys within PKI by configuring a KRA and enabling key archival on certificate templates, enabling data recovery for encrypted data.

Configure a certificate authority for key archival by enabling the key recovery agent template, archiving keys, and validating the key recovery agent certificate via CA console and PowerShell.

SSL uses certificates from public or internal CAs to authenticate servers and establish a secure, encrypted connection with a client through a handshake that creates a symmetric key.

Learn how certificates protect content and verify the author by enabling digital signatures with PKI. Discover signing workflows, digest creation, private/public keys, trust checks, and cross-domain considerations.

Learn how certificates enable content encryption with a hybrid approach in EFS and email encryption, using a symmetric file key and the public key to protect and recover data.

Explore digitally signing a Word document using a user certificate and signature line, then encrypt a file with EFS to protect contents on Windows.

Configure and deploy certificates in Windows PKI, creating production web server and user templates, enabling auto-enrollment, smart card sign-in, and key recovery for Office documents.

Explore deploying and using certificates in a simulated enterprise with the ADCS role on Windows Server 2016, covering template creation, auto-enrollment, issuance, and signing with certificates.

Navigate certificate management challenges in multi-forest environments, where each forest CA operates independently, requiring coordinated templates, enrollment policies, and revocation across all forests.