——  Courses

PKI Training: Implementing and Managing a Microsoft AD CS PKI

This 4-day PKI training teaches you how to design, deploy and manage an enterprise public key infrastructure with Microsoft Active Directory Certificate Services (AD CS), through extensive hands-on labs.

Public Key Infrastructure (PKI) is a cornerstone of modern IT security, enabling authentication, encryption, digital signatures and secure communications.
This course covers PKI concepts from the fundamentals to advanced enterprise use cases, with a focus on real-world deployment and administration.
Through guided practical exercises, participants will:

  • install and configure a multi-level PKI
  • manage certificate templates
  • automate enrolment
  • implement key archiving and recovery
  • secure data with EFS
  • sign PowerShell scripts
  • deploy smart card authentication
  • use certificates to secure services such as VPN

The course focuses on operational security, best practice and troubleshooting.

Also available with EJBCA instead of Microsoft AD CS.

By the end of the course, you will be able to:

  • Understand PKI concepts, standards and trust models
  • Design and deploy an enterprise PKI architecture
  • Install and configure root and subordinate certification authorities
  • Manage certificate templates and enrolment policies
  • Set up automatic enrolment via Group Policy Objects (GPOs)
  • Manage the certificate lifecycle (renewal, revocation, CRL)
  • Enable key archiving and restore certificates
  • Configure EFS and recovery agents (DRA)
  • Sign and verify PowerShell scripts
  • Deploy smart card authentication
  • Secure services (VPN, etc.) with certificates
  • Apply PKI best practices

As this is a technical course, participants must have a good understanding of IT security, Windows servers (Active Directory, Windows Server, etc.), system administration and Internet protocols. The target audience is:

  • System and infrastructure administrators
  • Security engineers and architects
  • IAM specialists
  • IT professionals responsible for certificate-based security
  • Engineers working with Windows Server / Active Directory

Module 1 · Cryptography & PKI Fundamentals (3.5 h)

  • Security objectives: confidentiality, integrity, authentication, non-repudiation.
  • Symmetric vs asymmetric cryptography.
  • Hash functions and digital signatures.
  • PKI: objectives and use cases.
  • Certificates and chains of trust.
  • Standards: X.509, PKCS, TLS.

Workshop — Protocol analysis (FTP vs HTTP), network capture, Diffie-Hellman simulation.

Module 2 · Secure Communications & OpenSSL (3.5 h)

  • Key pairs.
  • CSR (Certificate Signing Request).
  • Certificate validation.
  • Limitations of asymmetric encryption.
  • Hybrid models.

Workshop — SSH installation, key-based authentication, OpenSSL: key generation, certificates, signatures, secure file exchange.

Module 3 · PKI Architecture (3 h)

  • PKI types: internal, public, restricted.
  • Hierarchical architectures.
  • CA / RA roles.
  • Certificate Policy (CP) and Certification Practice Statement (CPS).
  • Security: offline Root CA, HSM, etc.

Workshop — Designing a PKI architecture, lab preparation.

Module 4 · Deploying an Offline Root CA (4 h)

  • Securing the Root CA.
  • Certificate validity periods.
  • Certificate Revocation Lists (CRL).
  • Audit.

Workshop — Root CA installation, configuring CDP / AIA extensions.

Module 5 · Subordinate CA (2.5 h)

  • Chain of trust.
  • Integration with IIS.

Workshop — Sub CA installation, certificate publication.

Module 6 · OCSP (2.5 h)

  • Deployment strategies.
  • OCSP vs CRL.

Workshop — OCSP service installation, testing.

Module 7 · Certificate Stores (2 h)

  • Windows certificate stores.
  • Certificate formats: PFX, CER.

Workshop — Certificate import/export, SSL/TLS authentication.

Module 8 · Key Archival & EFS (2 h)

  • Key archival.
  • KRA / DRA (Key Recovery Agents / Data Recovery Agents).
  • File encryption with EFS.

Workshop — Certificate recovery, file encryption.

Module 9 · Automation (1.5 h)

  • Certificate templates.
  • Auto-enrollment.

Workshop — GPO configuration, testing.

Module 10 · Code Signing (1.5 h)

  • Code signing principles.
  • Signing PowerShell scripts.

Workshop — Script signing.

Module 11 · Smart Cards (2 h)

  • Multi-factor authentication (MFA).
  • Enrollment agents.

Workshop — Smart card and YubiKey token authentication.

Module 12 · Use Cases & Conclusion (4 h)

  • Certificate-based VPN.
  • PKI best practices.
  • PKI audit.

Workshop — SSTP VPN, end-to-end validation.

Funding

This training course is eligible for funding from your OPCO under the skills development scheme (Qualiopi-certified organisation). Please contact your OPCO or our team to find out more about the arrangements and to put together your funding application

Accessibility

We pay particular attention to the accessibility of our training courses. People with disabilities are invited to contact us in advance so that we can adapt the teaching methods and logistical arrangements where necessary. A disability liaison officer has been appointed to assess each situation on a case-by-case basis. Email: referent-handicap@ace-multipass.fr

What are the prerequisites for this course?
You need a good knowledge of IT security, Windows Server and Active Directory, as well as basic system administration and Internet protocols.

Do I need prior knowledge of cryptography?
No. The first module covers the fundamentals: symmetric and asymmetric encryption, hashing, digital signatures and certificates.

Can the course be delivered with a solution other than Microsoft AD CS?
Yes, the course can be adapted to EJBCA. Just mention it when you request a quote.

What equipment do I need?
A laptop with Internet access. The hands-on lab environment is provided.

How is this different from the PKI Masterclass?
This 4-day course teaches you how to deploy and manage a PKI step by step. The one-day PKI Masterclass is aimed at experienced professionals and focuses on architecture, large-scale management and real-world lessons learned.

Can the course be funded?
Yes. ACE-MULTIPASS is Qualiopi-certified, so French companies can have the course funded by their OPCO. For other countries, contact us to discuss your options.

Related Trainings

  • IAM Training: Identity Management and Federation

    4 days

  • PKI Masterclass: Real-World Lessons and Architecture Review

    1 day

  • Cybersecurity Awareness Training

    4 Hours

Price :2800€

Duration :4 days

Format : Face-to-face, Distance learning

Registration