Certificate Authority role on a Virtual Machine

[TekkieDave]

Any know of any potential issues with installing the CA role on a hyper-v VM?

I've been reading that installing the CA role on a domain controller isn't a good idea, so I decided to put it on another machine, but I don't want to dedicate hardware to this task.

Is anything going to come back and bite me?

 

[mrdenny]

My CAs are all VMs (under ESX not Hyper-V) and they work fine.

Denny
MVP
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / SQL 2005 BI / SQL 2008 DBA / SQL 2008 DBD / SQL 2008 BI / MWSS 3.0: Configuration / MOSS 2007: Configuration)
MCITP (SQL 2005 DBA / SQL 2008 DBA / SQL 2005 DBD / SQL 2008 DBD / SQL 2005 BI / SQL 2008 BI)

My Blog

 

[TekkieDave]

Awesome, thanks for the reply.

 

[kmcferrin]

There's no issue with CAs on VMs. In fact, if you want to deploy a standalone root CA that is offlined for security, then doing it with a VM is a good way to avoid wasting resources on it.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[TekkieDave]

Do you guys typically place the CA roles on a server that is doing only CA? As opposed to adding it to a server that already has other roles assigned?

 

[kmcferrin]

I would. MS best practice is one role per server, but most people ignore that. One place that I wouldn't ignore that is with anything security related, like certificates. The fewer services it is running the fewer opportunities there are to exploit it.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[mrdenny]

As everything in my environment is a VM (with like 5 exceptions out of 200) yes everything gets its own VM including the CA.

Denny
MVP
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / SQL 2005 BI / SQL 2008 DBA / SQL 2008 DBD / SQL 2008 BI / MWSS 3.0: Configuration / MOSS 2007: Configuration)
MCITP (SQL 2005 DBA / SQL 2008 DBA / SQL 2005 DBD / SQL 2008 DBD / SQL 2005 BI / SQL 2008 BI)

My Blog