Initial Configuration of the ADCS Connector

Before proceeding with the setup, please ensure that the ADCS Connector program is correctly installed and stopped.

The connector can be installed on the ADCS server itself or on another machine in the same domain. For the latter, install the Remote Server Administration Tools (RSAT) for Active Directory Certificate Services on that machine. You can use the server manager to add the feature "AD CS and AD LDS Tools" under "Remote Server Administration Tools" > "Role Administration Tools" > "AD CS Tools"

ADCS connector diagram

TLS Certificate

Enroll a TLS Web Server certificate with the "Server Authentication" and a SAN DNS that will have the DNS name you are going to use for this ADCS machine and import it in the certificate store of the ADCS machine.

Retrieve the hash of that certificate through certlm.msc. Be careful as some special characters may be copied alongside with the hash, so ensure that you get rid of them should they be present.

Connector Configuration

Edit the C:\Program Files\EverTrust\ADCSConnector\EverTrustADCSConnector.exe.config file and paste the previously copied hash to be the value of the "CertHash" line, then save the file.

Please don’t copy the file from one installation to another as the content may differ from one version to another.

Network Configuration

Ensure that the port 4443 is opened in the firewall of this machine and that the machine can indeed be reached from the Horizon machine.

Using services.msc, start the "EverTrust ADCS Connector" service. To see whether the service started successfully, start Internet Explorer and go to https://localhost:4443/api/certificate. This should download a JSON file that says "OK" if everything is good.

Template & Permissions

Create a new certificate template on the ADCS (or use an existing one) that the connector will use to enroll the certificates.

Create a technical account to manage the connector:

  • Give it the right to enroll on the previously created template

    Log in rights

  • Give it the right to Issue and Manage Certificates on the ADCS

    Log in rights

Enrollment Agent

Create an enrollment agent certificate and export it as PKCS#12. This certificate will be the one used to sign the CMC messages from Horizon.

After configuring the ADCS Connector, you can go back and proceed with the creation of the MSADCS PKI Connector in Horizon.