Installing the Certificate Server CA

A Certificate Server CA can function as the top level (root) of a chain of trust or can run stand-alone. Computers running the Certificate Server Web client and computers running Certificate Server as a subordinate CA require a Certificate Server CA to sign certificates, issue certificates, and issue Certificate Revocation Lists (CRLs) for clients to use.

Before installing the Certificate Server CA, you must install Internet Explorer 4.01 or later on the server computer. You must also create a shared directory where Certificate Server will store certificates. The Windows NT Everyone account should have Read permission on the shared directory.

After installing the Certificate Server, you must install the Exchange policy module and Certificate Server hot fix before the Certificate Server can use KM server.

To install the root CA

Run the Windows NT Option Pack 4 Setup program and choose Custom.
On the Components page, select Certificate Server, and then choose Show Subcomponents.
Select Certificate Server Certifying Authority, and then choose Next.
On the Microsoft Certificate Server page, in the Shared Folder box, enter the path to the shared certificate directory on the CA computer, and then choose Next.
Select Show Advanced Configuration, and then choose Next.
In the Hash Algorithm box, choose SHA-1.
Verify that Root CA is selected, and then choose Next.
Type the information describing your CA, and then choose Next.
After the computer reboots, install the Microsoft Exchange Server policy module and the Certificate Server hot fix.

To install the Microsoft Exchange Server policy module and the Certificate Server hot fix

In Control Panel, double-click Services, and then stop the Certificate Authority service.
Download the Certificate Server hot fix from FTP://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/certserv and install it. This fix is also included in Microsoft Windows NT Server version 4.0 Service Pack 4.
Copy the Expolicy.dll file from the Eng\Support\KMS\Expolicy\<operating system> directory on the Microsoft Exchange Server 5.5 Service Pack 1 compact disc to the Winnt\System32 directory on your Certificate Server computer.
At the command prompt, type regsvr32 c:\winnt\system32\expolicy.dll to register the policy module.
In Control Panel, double-click Services, and then restart the Certificate Authority service.