> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create a Microsoft CA Key Recovery Agent

You need a Key Recovery agent to perform a key recovery operation.

note

Changes to the Microsoft CA CRL information (for example, enabling/disabling HTTP or LDAP Certificate Revocation List (CRL) distribution points) can result in the Key Recovery Agent becoming invalid. When this happens encoding will fail. When you make Microsoft CA CRL configuration changes you need to ensure that you publish the new CRL to your LDAP or HTTP distribution points.

## Create a key recovery agent PKCS12 store

1. On the Microsoft CA machine, go to **Start > Windows Administrative Tools >** **Certification Authority**.

2. Click your Certificate Authority to expand the root folder.

   ![Root Folder](/assets/images/root-folder-f70cabd09cdf2326b9799c92cb6c3af3.png)

3. Right-click **Certificate Templates** and select **Manage**.

4. Right-click **Certificate Templates**, and then select **Manage**. The **Certificate Templates Console** appears.

   ![Certificate Templates Console](/assets/images/certificate-templates-console-f26a8f550533de26c1fa7e4fd1135a40.png)

5. Right-click the **Key Recovery Agent** and select **Duplicate Template**. The **Properties of New Template** dialog box appears.

   ![Properties of New Template](/assets/images/properties-of-new-template-24a60b486aa4395d56f01f61c0c8b70b.png)

6. In the **Compatibility Settings**, select the following:

   1. From the **Certificate Authority** drop-down list, select
      - **Windows Server 2012R2** if you are running on a 2012R2 server
      - **Windows Server 2016** if you are running on Windows Server 2016 or later
   2. From the **Certificate Recipient** drop-down list, select
      - **Windows 8.1/Windows Server 2012R2** if you are running on a 2012R2 server
      - **Windows 10/Windows Server 2016** if you are running on Windows Server 2016 or later
   3. (Optional) If the **Show resulting changes** check box is selected, a message lists options added with your choice. Click **OK** to dismiss the message.

7. Click the **General** tab and enter a name in the **Template display name** field.

8. Click the **Request Handling** tab and select **Allow private key to be exported**.

9. Click the **Issuance Requirements** tab and do the following:

   1. Do not select **CA certificate manager approval**.
   2. Select **The number of authorized signatures** and enter **1** in the text box.
   3. From the **Policy type required in signature** drop-down list, select **Application policy**.
   4. From the **Application policy** drop-down list, select **Certificate Request Agent**

10. Click the **Security** tab and under **Permissions for Authenticated Users** reduce the permissions to no more than **Read**.

11. Add the `<domain_user>` and select **Read** and **Enroll**.

12. Review the permissions for other users and groups in the list to make sure they follow your corporate access policy.

13. Click **OK**.

14. Go to **Certification Authority**, right-click **Certificate Templates** and select **New > Certificate Template to Issue**.

15. Select the **Key Recovery** template you just created and click **OK**.

16. Create a new user in Active Directory, as follows:

    1. Go to **Start > Windows Administrative Tools > Active Directory Users and Computers**. The Active Directory Users and Computers page appears.
    2. Right-click **Users** and select **New > User**. The **New Object > User** dialog box appears.
    3. Enter a **First name**, **Last name**, and **User logon name** and then click **Next**.
    4. Deselect **User must change password at next logon**.
    5. Enter and confirm a **password**.
    6. Click **Next** and then click **Finish**.

17. Open the **Microsoft Management Console** to add certificates snap-in, as follows:

    1. To open the Microsoft Management Console, right-click the **Start** menu, click **Run**, enter **mmc** in the **Open** field, and click **OK**.
    2. Go to **File > Add/Remove Snap In**.
    3. Click **Certificates** and select **Add**. The **Certificate snap-in** dialog box appears.
    4. Select **My user account**.
    5. Click **Finish** and click **OK**.

18. Click **Certificates > Current User**.

19. Right-click **Personal** and select **All Tasks > Advanced Operations > Enroll on Behalf Of**. The Certificate Enrollment Wizard opens.

20. Click **Next**. The **Select Certificate Enrollment Policy** page appears.

21. Click **Browse** to select the certificate you created in [Create a Microsoft CA Enrollment Agent](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/create-a-microsoft-ca-enrollment-agent.md). The **Select a Certificate** dialog box appears.

22. Click **OK** to select the certificate and close the dialog box. A certificate name appears in the **Signing Certificate** field.

23. Click **Next**. The **Request Certificates** page appears.

24. Select your **Key Recovery** certificate template and click **Next**. The **Select a user** page appears.

25. Enter the **User name or alias** that you created in step 14.

    Alternately, you can click **Browse** to display the **Select User** dialog box and search for the user.

26. Click **Enroll** and the click **Close**.

27. Select **Certificates > Current User**.

28. Double-click **Personal** and then double-click **Certificates**.

29. Right-click your user **Recovery Key** certificate and select **All Tasks > Export**. The **Certificate Export Wizard** opens.

note
You may need to refresh your display to see the certificate. You can identify the certificate by locating the certificate in the **Issued to** column that matches the user created in step 14.

30. Click **Next**. The **Export Private Key** page appears.

31. Select **Yes, export the private key** and click **Next**.

32. In the **Export File Format** page, do the following:

    1. Select **Personal Information Exchange - PKCS #12 (PFX)**.
    2. Select **Include all certificates in the certificate path if possible**.
    3. Click **Next**. The **Security** page appears.

33. In the **Security** page, do the following:

    1. Select **Password**.
    2. Enter and confirm a certificate password.
    3. Click **Next**. The **File to Export** page appears.

34. In the **File to Export** page, enter a name for your certificate, for example, recover.

tip
Click **Browse** to browse to the location where you want to save your certificate, enter a **File name** and click **Save**.

35. Click **Next** and then click **Finish**.

36. Click **OK** on the Export successful confirmation prompt.

37. Copy and save this file. You need this file to [Configure a Microsoft CA in Identity as a Service](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-a-microsoft-ca-in-idaas.md).

## Perform key recovery

Complete the following procedure to allow Identity as a Service to perform a key recovery.

1. On the Microsoft CA machine, go to **Tools** and select **Certification Authority**.

2. Right-click your certification authority and select **Properties**. The **CA Properties** dialog box appears.

   ![CA Properties](/assets/images/ca-properties-a000ac7958ec17be08c8b19ad38cd70f.png)

3. Click the **Recovery Agents** tab and do the following:

   1. Select **Archive the key**.

   2. Enter the number of recovery agent you are using (typically 1) in the **Number of recovery agents to use** text box.

   3. Click **Add**. The **Recovery Key Agent Selection** dialog box appears.

      ![Recovery Key Agent Selection](/assets/images/kra-recovery-agent-2cc82a047e7728daf60475e531c45615.png)

   4. Select the **Key Recovery Agent Certificate** that you created in the previous steps, then select **OK**. You are prompted to restart your CA.

4. Click **Apply**. The Recovery Agent certificate is added.

5. Click **OK** to close the **CA Properties** dialog box.