Hands-On Labs

PKI Training Labs

Hands-on lab exercises for isolated training environments. Build, configure, and validate a complete two-tier Microsoft ADCS PKI hierarchy — from offline Root CA to enterprise Issuing CA, HTTP CDP/AIA publication, and SSL certificate issuance.

Lab Environment Notice

All lab exercises are for isolated training environments only. Do not use these procedures directly in production without organizational approval, change control, backup validation, and security review. Lab VMs must not be connected to production or corporate networks.

Lab Topology

Two-Tier PKI Lab Environment

The training lab uses five VMs in an isolated network. Each VM has a specific role in the PKI hierarchy.

Tier 1 — Offline

Root CA VM

Offline after configuration · No network

Tier 2 — Online

Enterprise Issuing CA VM

Domain-joined · IIS for CDP/AIA

Domain Controller

AD, DNS, GPO

Web Server (IIS)

HTTP CDP/AIA

Client VM

Auto-enrollment

Isolated Host-Only Network · No Internet

Root CA VM

Windows Server — Offline Root CA No network connectivity after configuration

Issuing CA VM

Windows Server — Enterprise Issuing CA Domain-joined, online, IIS for CDP/AIA

Domain Controller

Windows Server — Active Directory DNS, Group Policy, AD CS enrollment

Client VM

Windows 10/11 — Domain-joined Auto-enrollment testing, certutil validation

Web Server (IIS)

Windows Server — IIS HTTP CDP/AIA publication, training SSL cert

Lab Requirements

What You Need

Hypervisor

VMware Workstation, Hyper-V, or VirtualBox — any modern hypervisor supporting multiple VMs

RAM

Minimum 16 GB host RAM recommended (4–8 GB per VM depending on role)

Storage

Minimum 200 GB free disk space for VM images and snapshots

Network

Isolated host-only or internal network — no internet connectivity required or recommended

OS Licenses

Windows Server evaluation ISOs (180-day trial) available from Microsoft Evaluation Center

Isolation

Lab network must be fully isolated from production — no routing to corporate or internet networks

Lab Courses

Courses with Hands-On Labs

Level 3Available

Build an Offline Root CA

Lab: Build an Offline Root CA

Install, configure, and validate an offline Root CA in an isolated training VM environment.

Start

Level 3Coming Soon

Build an Enterprise Issuing CA and HTTP CDP/AIA Publication

Lab: Build an Enterprise Issuing CA

Deploy an enterprise Issuing CA, configure HTTP CDP/AIA, and validate the full two-tier PKI chain.

Level 5Coming Soon

PKIView, certutil, and Training SSL Certificate Capstone

Capstone Lab: Issue and Validate a Training SSL Certificate

Issue a training SSL certificate, validate the full chain, and confirm revocation infrastructure.

Before You Start

Lab Safety Checklist

Lab VMs are on an isolated host-only or internal network

Lab network has no routing to production or corporate networks

Lab network has no internet connectivity

Snapshots are taken before each major configuration step

Lab CA certificates are not imported into production trust stores

Lab credentials are not reused from production accounts

Lab procedures are reviewed before execution — not copy-pasted blindly

Organizational approval obtained before any production work

Ready to Build the Lab?

Start with the offline Root CA course and work through to the full two-tier PKI capstone.

Start Root CA Lab View All Courses