> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure Microsoft CA Proxy

Complete the following to configure the Microsoft CA Proxy:

## Step 1: Create a client authentication template for Microsoft CA

1. On the **Microsoft CA** machine, go to **Start > Windows Administrative Tools >** **Certification Authority**.

2. Click your Certificate Authority to expand the root folder.

   ![Root Folder](/assets/images/root-folder-f70cabd09cdf2326b9799c92cb6c3af3.png)

3. Right-click **Certificate Templates**, and then select **Manage**. The **Certificate Templates Console** appears.

   ![Certificate Templates Console](/assets/images/certificate-templates-console-f26a8f550533de26c1fa7e4fd1135a40.png)

4. Scroll the template list, right-click the **User** template and select **Duplicate Template**. The **Properties of New Template** dialog box appears.

   ![Properties of New Template](/assets/images/properties-of-new-template-24a60b486aa4395d56f01f61c0c8b70b.png)

5. Click the **Security** tab and under **Permissions for Authenticated Users** reduce the permissions to no more than **Read**.

6. Add the `<domain_user>` and select **Read** and **Enroll**.

7. For all other users and groups, review the permissions and ensure that they have the desired corporate access policy.

8. In the **Compatibility Settings**, select the following:

   1. From the **Certificate Authority** drop-down list, select
      - **Windows Server 2012R2** if you are running on a 2012R2 server
      - **Windows Server 2016** if you are running on Windows Server 2016 or later
   2. From the **Certificate Recipient** drop-down list, select
      - **Windows 8.1/Windows Server 2012R2** if you are running on a 2012R2 server
      - **Windows 10/Windows Server 2016** if you are running on Windows Server 2016 or later
   3. Optional. If the **Show resulting changes** check box is selected, a message lists the options that will be added with your choice. Click **OK** to close the message.

9. Click the **General** tab.

10. In the **Template display name** field, enter `Client Authentication`.

11. Review the **Validity Period**. Extend it if necessary.

12. Click the **Subject Name** tab.

13. Select **Supply in the request** radio button and click **OK** on the warning dialog box.

14. Click the **Extensions** tab.

15. Select **Applications Policies** and click **Edit**. The **Edit Application Policies Extension** dialog box appears.

16. Select and remove **Encrypting File System** and **Secure Email** and then click **OK**.

17. Click **OK** to close the **Properties of Template** dialog box.

18. Return to the **Certification Authority**.

19. Click to expand your certification authority root folder.

20. Right-click **Certificate Templates** and select **New > Certificate Template to Issue**. The **Enable Certificate Template**s dialog box appears.

21. Select **Client Authentication** and click **OK**.

## Step 2: Generate the Microsoft CA Proxy Server truststore

1. On the Microsoft CA Proxy Server machine, create an SSL directory under MS CA Proxy installation (for example, `c:\mscaproxy\ssl)`.

2. Open a command prompt.

3. Run the following commands where

   - `truststorepwd` = The trust store password
   - `ca_host` = CA host name
   - `ca_name` = CA name. You can find the CA name at **Certification Authority > Properties > General > Name**.

   ```cmd
   certutil -config <ca_host>\<ca_name> -ca.cert caroot.cer
   ```

4. In this directory, run the following command to include the root CA certificate (for example, `caroot.cer`)

   ```cmd
   keytool -import -noprompt -alias caroot -file caroot.cer -keystore truststore.jks -storepass <truststorepwd>
   ```

5. If your CA has intermediate CA certificates, obtain these certificates from your CA then run the following command for each of them to import the corresponding issuing certificate (for example, `ca-issuing.cer`).

   ```cmd
   keytool -import -noprompt -alias ca-issuing -file ca-issuing.cer -keystore truststore.jks -storepass <truststorepwd>
   ```

## Step 3: Configure SSL for the Microsoft CA Proxy Server

To configure SSL for the **Microsoft CA Proxy Server**, you need to generate a `mscaproxy.jks` keystore containing the following:

- The Microsoft CA Proxy private key for SSL server authentication
- The key's certificate
- The certificate chain
- The Microsoft CA Proxy certificate

### Generate a Server JKS

1. On the Microsoft CA Proxy Server machine, go the SSL directory under the Microsoft CA proxy directory (`c:\mscaproxy\ssl`).

2. Open a command prompt.

3. Run the following commands where

   - `keypwd` = private key password
   - `keystorepwd` = JKS password
   - `ca_proxy_fqdn` = Microsoft CA proxy server fully qualified domain name.
   - `ca_host` = CA host name
   - `ca_name` = CA name. You can find the CA name at **Certification Authority > Properties > General > Name**.

   ```powershell
   keytool -genkey -noprompt -alias mscaproxy -dname "cn=<ca_proxy_fqdn>" -keyalg RSA -keysize 2048 -keystore mscaproxy.jks -storepass <keystorepwd>

       keytool -certreq -alias mscaproxy -ext SAN=dns:"<ca_proxy_fqdn>" -file mscaproxy.csr -keystore mscaproxy.jks -storepass <keystorepwd>

       certreq.exe -f -attrib "CertificateTemplate:WebServer" -config "<ca_host>\<ca_name>" mscaproxy.csr CertChainFileOut mscaproxy.p7b

       keytool -import -noprompt -alias mscaproxy -file mscaproxy.p7b -keystore mscaproxy.jks -storepass <keystorepwd>

       keytool -export -noprompt -alias mscaproxy -file mscaproxyserver.cer -keystore mscaproxy.jks -storepass <keystorepwd>
   ```

note

**Note:** You need the generated mscaproxyserver.cer file located in the ssl directory when you [Configure a Microsoft CA in Identity as a Service](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-a-microsoft-ca-in-idaas.md).

## Step 4: Generate a Client PKCS12 for Identity as a Service

To generate a client PKCS12, you need to generate a mscaproxyclient.pfx keystore containing the following:

- The CA Gateway's private key for client authentication
- The key's certificate
- The certificate chain

### Generate a client PKCS12

1. On the **Microsoft CA Proxy Server** machine, create a client directory under the Microsoft CA proxy directory (`c:\mscaproxy\client`).

2. Open a command prompt.

3. Run the following commands where

   - `keystorepwd` = the PKCS12 password
   - `ca_host` = CA host name
   - `ca_name` = CA name. You can find the CA name at **Certification Authority > Properties > General > Name**.

   ```powershell
   keytool -genkey -noprompt -alias mscaproxyclient -dname "cn=mscaproxy client" -keyalg RSA -keysize 2048 -keystore mscaproxyclient.pfx -storetype PKCS12 -storepass <keystorepwd>

       keytool -certreq -alias mscaproxyclient -file mscaproxyclient.csr -keystore mscaproxyclient.pfx -storepass <keystorepwd>

       certreq.exe -f -attrib "CertificateTemplate:ClientAuthentication" -config "<ca_host>\<ca_name>" mscaproxyclient.csr CertChainFileOut mscaproxyclient.p7b

       keytool -import -noprompt -alias mscaproxyclient -file mscaproxyclient.p7b -keystore mscaproxyclient.pfx -storepass <keystorepwd>
   ```

note

You need the generated mscaproxyclient.pfx file located in the client directory when you [Configure a Microsoft CA in Identity as a Service](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-a-microsoft-ca-in-idaas.md).

## Step 5: Edit the application.yml file and the keystore and truststore passwords

1. On the **Microsoft CA Proxy Server** machine, go to `<msca_install>/config` and open `application.yml` with a text editor.
2. Uncomment all lines in the file by removing the #.
3. Save and close the file.
4. Go to `<msca_install>/config` and open `key-store-password.scrt` with a text editor.
5. Set `decrypted=<keystorepwd>` where `<keystorepwd>` is the password of the JKS file you created in the section, "[Configure SSL for the Microsoft CA Proxy Server](#step-3-configure-ssl-for-the-microsoft-ca-proxy-server)."
6. Save and close the file.
7. Go to `<msca_install>/config` and open `trust-store-password.scrt` with a text editor.
8. Set `decrypted=<truststorepwd>` where `<truststorepwd>` is the password of the JKS file you created in the section, "[Generate the Microsoft CA Proxy Server truststore](#step-2-generate-the-microsoft-ca-proxy-server-truststore)."
9. Save and close the file.

## Step 6: Manage the Microsoft CA Proxy

As administrator, use the following commands to manage the **Microsoft CA Proxy Server machine**:

- `MSCAProxy start`
- `MSCAProxy stop`
- `MSCAProxy uninstall`
- `MSCAProxy restart`

You can also check to see whether the Microsoft CA Proxy is running.

### Check to see if the Microsoft CA Proxy is running

1. Open Chrome.

2. Start the Microsoft CA Proxy as follows:

   From a command prompt, enter

   ```powershell
   C:\\cd mscaproxy
   C:\mscaproxy\>MSCAProxy.exe start
   ```

3. Import into Chrome the `mscaproxyclient.pfx` file you created in [Step 4: Generate a client PKCS12 for Identity as a Service](#step-4-generate-a-client-pkcs12-for-identity-as-a-service).

4. Go to: <https://proxyserver:8443/MSCAProxy/rest/status/ping>, where proxyserver is the hostname of your Microsoft CA Proxy Server.

5. Check the server response for the following message to confirm that the Microsoft CA Proxy is running:

   `"MS CA proxy is running"`