OK to close the properties and commit the changes we’ve made to the CA.
5. When prompted to restart Certificate Services, click Yes.
Key archival is now enabled on the CA.
Additional information on the mechanics of Key Archival is available here: http://blogs.technet.com/pki/archive/2009/08/07/understanding-key-archival.aspx
Conclusion
And that’s it for this part of the series. Today, we configured the IIS server hosting our Web Enrollment pages to use SSL when serving the site. We also configured our CA with a Key Recovery Agent to enable Key Archival. Neither of these steps are required in order for the CA to issue certificates, but setting up the features properly will increase the usefulness of your PKI.
In the final segment in this series, I will cover Disaster Recovery Scenarios.
| 