PKI Web Repositories

Overview

VM ID	Hostname	IP	OS
312	srv-pki-zrh-01	10.30.30.22	Server 2025 Core
313	srv-pki-zrh-02	10.30.30.23	Server 2025 Core

DNS Round Robin

# On srv-dc-zrh-01
Add-DnsServerResourceRecordA -ZoneName "microsoftlab.ch" -Name "pki" -IPv4Address "10.30.30.22"
Add-DnsServerResourceRecordA -ZoneName "microsoftlab.ch" -Name "pki" -IPv4Address "10.30.30.23"

IIS Configuration (per server)

# Install IIS
Install-WindowsFeature Web-Server -IncludeManagementTools

# Create folder structure
New-Item -Path "C:\pki\aia" -ItemType Directory -Force
New-Item -Path "C:\pki\crl" -ItemType Directory -Force

# Create virtual directory
New-WebVirtualDirectory -Site "Default Web Site" -Name "pki" -PhysicalPath "C:\pki"

# Create aia and crl subdirectories
New-WebVirtualDirectory -Site "Default Web Site" -Name "aia" -PhysicalPath "C:\pki\aia"
New-WebVirtualDirectory -Site "Default Web Site" -Name "crl" -PhysicalPath "C:\pki\crl"

# Enable double escaping (required for CRL files)
Set-WebConfigurationProperty -Filter /system.webServer/security/requestFiltering -Name allowDoubleEscaping -Value $true -PSPath "IIS:\Sites\Default Web Site"

File Structure

C:\pki\
├── aia\
│   ├── MicrosoftLab Root CA 01.crt
│   └── MicrosoftLab Issuing CA 01.crt
└── crl\
    ├── MicrosoftLab Root CA 01.crl
    └── MicrosoftLab Issuing CA 01.crl

Verify Access

# Test from any machine
Invoke-WebRequest -Uri "http://pki.microsoftlab.ch/aia/" -UseBasicParsing
Invoke-WebRequest -Uri "http://pki.microsoftlab.ch/crl/" -UseBasicParsing