Deploying YubiHSM 2 with Active Directory Certificate Services
With a YubiHSM 2 device now configured for use with YubiHSM Key Storage Provider and Microsoft Active Directory Certificate Services, the next set of steps covers the deployment in the ADCS environment. Note that YubiHSM Key Storage Provider software must be installed on the system before proceeding.
Deploying YubiHSM consists of three steps as follows. These steps are described in detail in the following procedure.
- Configuring the Windows Registry for the YubiHSM Key Storage Provider for the primary YubiHSM 2 device that was configured earlier
- Configuring ADCS (if not already present)
- Configuring a new ADCS CA with a root CA key being generated on the device

Figure: Pre and Post Conditions
The host that these steps are performed on is assumed to be a member server in the Active Directory domain (domain-joined, not a Domain Controller).
These instructions include steps for a basic configuration and should be performed by an experienced system administrator.
Configuring the Windows Registry
For ADCS to use the YubiHSM 2, the following registry entries need to be changed from their default values. The HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM
subkey was created during installation. Be sure to make a backup of your Registry before you make any changes. To configure the Windows Registry
Step 1: | Click Start > Run, type |
---|---|
Step 2: | Locate and then click the registry subkey for YubiHSM ( |
Step 3: | To change the URI where the connector is listening, change the following entry: |
Step 4: | To change the ID of the application authentication key (object ID |
Step 5: | To change the password for the application authentication key that is stored in the registry change the entry for: |
Step 6: | To save your changes, exit the Windows Registry. The YubiHSM Connector service reads the configuration file, Depending on your local setup, for instance if you are running multiple instances of the software on the same host, you may need to edit this configuration file to make sure that parameters are consistent between the configuration file and the Windows Registry. On Windows, the |
Setting Up Your Enterprise Certificate Authority
To Configure ADCS
If you already have Certification Services installed, you can skip these steps.
Step 1: | On a Windows Server host, joined to an existing Active Directory domain, log on into the server as a domain administrator. |
---|---|
Step 2: | Click Start > Administrative Tools, then click Server Manager. |
Step 3: | Under Roles Summary, click Add roles and features. |
Step 4: | Use the Add Roles and Features Wizard to add the Active Directory Certificate Services role, and click Next |
Step 5: | In the Select role services wizard page, select the option for Certification Authority, then click Next. |
Step 6: | Complete the wizard and reboot the host if prompted. |
To Configure the ADCS CA and Create the Root Key
After you have completed the feature installation, you need to create the Enterprise CA instance.
Step 1: | If you haven’t already, do the following:
|
---|---|
Step 2: | In Server Manager, start the Add Roles and Features Wizard and select Role-based or feature based installation. Click Next. |
Step 3: | In the Credentials page, confirm that you are logged in as a |
Step 4: | In the Role Services page, select the option for Certification Authority, and then click Next. |
Step 5: | In the Setup Type page, select the option for Enterprise CA, and then click Next. |
Step 6: | In the CA Type page, select the option for Root CA, and then click Next. |
Step 7: | In the Private Key page, select the option for Create a new private key, and then click Next. |
Step 8: | In the Cryptography for CA page, do the following:
|
Step 9: | In the CA Name page, accept the defaults. Click Next. |
Step 10: | In the Validity Period page, accept the default or set another validity period appropriate for your purposes. Click Next. |
Step 11: | In the CA Database page, accept the default location for logs. Click Next. |
Step 12: | In the Confirmation page, the important detail is that the The Progress page appears, briefly, as the local CA database is created, and changes are written to Active Directory. |
Step 13: | Finally, confirm the presence of the |