--- title: "Infisical vs. Microsoft AD CS" description: "How Infisical and Microsoft Active Directory Certificate Services differ on ACME, Linux and Kubernetes, expiry alerts, and delivery, how to run Infisical in front of AD CS, and how to migrate." canonical: "https://infisical.com/compare/infisical-vs-microsoft-adcs" last-reviewed: "2026-10-09" source-index: https://infisical.com/llms.txt --- # Infisical vs. Microsoft AD CS Looking for an AD CS alternative? Infisical automates certificate lifecycles for all of your workloads, devices, and infrastructure. It can replace AD CS or sit on top of it to provide a single source of truth for certificate management. ## Microsoft AD CS and Infisical in brief Facts checked against current docs on 2026-10-09. Each section below goes deeper. | | Infisical | Microsoft AD CS | |---|---|---| | What it is | One platform for certificates, secrets, privileged access, and KMS, with certificate lifecycle management built in | A Windows Server role that runs certificate authorities for an Active Directory domain | | License | MIT-licensed open-source core | Proprietary, included with Windows Server licenses | | Deployment | Infisical Cloud in US and EU regions, or self-hosted on Docker, Kubernetes, Linux packages, AWS ECS with Fargate, or Google GKE | Self-managed on Windows Server only, with Active Directory for enterprise CAs | | Software to run | One platform, plus a gateway where it has to reach a private network | An offline root, issuing CAs, CRL and AIA publishing, and IIS roles for web enrollment, NDES, and CEP/CES | | Certificate authorities | Its own private CA hierarchy, plus public CAs, AD CS, and other enterprise CAs | Its own CAs only | | Enrollment | ACME, EST, SCEP, and a REST API, all built in | Group Policy autoenrollment for Windows, SCEP through NDES, and web enrollment. No ACME, EST, or REST API | | Linux and Kubernetes | ACME clients, the cert-manager issuer, and the Infisical Agent | Manual CSRs and PFX conversions, or third-party add-ons | | Renewal | Automatic, through syncs, agents, or ACME clients | Automatic for domain-joined Windows through autoenrollment. Everything else is manual or scripted | | Expiry alerts | Email, Slack, PagerDuty, and webhooks | None built in. Teams write scripts | | Discovery and inventory | Scans networks for any certificate and keeps one inventory across every CA | Each CA's own database, queried with certutil | | Delivery to targets | Certificate syncs to 13+ destinations, including Windows servers, with no agent | Export and import by hand | | Sign-in | SAML, OIDC, and LDAP | Windows and Active Directory accounts | | Working together | Issues from AD CS templates through a gateway, or has AD CS sign an Infisical intermediate | Keeps Group Policy autoenrollment for domain-joined Windows machines | | Getting started | Sign up free, or self-host the open-source core | Add the role to Windows Server and design the hierarchy | ## What's the difference between Infisical and Microsoft AD CS? AD CS is a role of Windows Server, built to issue certificates to Windows machines in an Active Directory domain. Everything outside it takes add-ons, scripts, or specialized engineers. Infisical is a certificate management platform for your entire infrastructure, and can keep AD CS as the CA behind it. | Stage | Infisical | Microsoft AD CS | |---|---|---| | Evaluate | Try the free tier with an internal CA, ACME automation, and the certificate dashboard; Self-host the MIT-licensed open-source version | Included with Windows Server licenses; Manually build a lab with Windows Server and Active Directory | | Deploy/integrate | Use managed cloud, or self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE; Connect AD CS through a gateway, without exposing it | Install Active Directory and install AD CS on Windows Server, frequently reboot; Stand up an offline root, issuing CAs, and a separate NDES server with IIS; Patch every CA and NDES server on Patch Tuesday | | Migrate/onboard | Keep AD CS and issue from its templates over ACME, EST, and SCEP; Discover every certificate on your network, whoever issued it; Stand up your own private CAs to replace or augment AD CS | Duplicate and publish a template for each use case; Hand-carry CSRs for anything outside the domain | | Control access | Sign in with any SSO; Set fine-grained access controls with RBAC and ABAC | Manually create, manage, and maintain the template permissions that decide who can enroll; Hit NDES's default limit of five unused challenge passwords | | Operate | Continually discover new certificates to build an inventory; Manage every certificate expiry in one dashboard, no matter who issued it; Renew, revoke, or reissue from the dashboard or API | Query each CA's database manually with certutil; Manually convert and copy certificates for anything beyond Windows; Pray NDES doesn't break when you renew enrollment certificates | | Automate | Renew certificates automatically on Windows, Linux, and Kubernetes; Get a Slack, email, PagerDuty, or webhook alert before anything expires; Sync certificates to load balancers, cloud services, and Windows servers | Autoenrollment only covers domain-joined Windows; Script your own expiry alerts or keep track manually; Republish the offline root's CRL before it expires | | Audit | Search audit logs in the dashboard or stream them to a SIEM | Turn on CA auditing and read the Windows event log | | Scale | Add secrets, privileged access, AI agent security, or KMS on the same platform; Incorporate any new CA or certificate into the platform | Move each CA to a new Windows Server version yourself; Build a specialized PKI team by hiring more engineers; Buy separate tools for secrets and other security infrastructure | ## Infisical vs. Microsoft AD CS at a glance AD CS is a Windows Server role to issue certificates inside the domain. Infisical is a certificate lifecycle automation platform for every workload or device anywhere. ### Platform and deployment Where each product runs, what it's built on, and what it covers. | Feature | Infisical | Microsoft AD CS | |---|---|---| | Certificate product | Full lifecycle management, for any CA and any workload | A Windows Server role | | Open source | MIT-licensed, 29,000+ GitHub stars | Proprietary Windows Server role | | Self-hosting | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | Windows Server and Active Directory | | Managed cloud | US and EU regions | Self-managed only | | Components to run | One platform, plus a gateway | CA servers, an offline root, IIS, and NDES | | Platform scope | Certificates, secrets, privileged access, AI agents, and KMS | Certificates for Windows and Active Directory | **Certificate product.** Infisical Certificate Management is a product built for certificate management across your entire infrastructure: it runs its own CAs, issues from AD CS and public CAs, discovers certificates on your networks, keeps one inventory, renews automatically, alerts before expiry, and installs certificates where they're served, on Windows, Linux, Kubernetes, and cloud services alike. AD CS is a Windows Server role, a sophisticated one with its own certification authority, web enrollment, NDES, and online responder services, built to issue certificates to Windows machines in an Active Directory domain. Anything beyond that, from ACME to inventory to delivery, takes add-ons, scripts, or a separate product. Docs: [Certificate Management](https://infisical.com/docs/documentation/platform/pki/overview). **Open source.** Infisical's core is published under the MIT license, with over 29,000 GitHub stars, so a security team can read the code it deploys and test it before talking to anyone. AD CS is a proprietary Windows Server role. Docs: [Deployment models](https://infisical.com/docs/documentation/getting-started/concepts/deployment-models). **Self-hosting.** Infisical self-hosts as a single container, with Docker Compose, on Kubernetes with the official Helm chart, or as a Linux package, on PostgreSQL and Redis. AD CS runs only on Windows Server, and an enterprise CA needs Active Directory. Moving a CA to a newer Windows Server is its own project: templates, keys, and the CA database have to come across, and keys held by an older provider can't always be exported. Docs: [Self-hosting overview](https://infisical.com/docs/self-hosting/overview). **Managed cloud.** Infisical Cloud runs in US and EU regions. Where it has to reach a private network, such as an AD CS server, one gateway connects out, so no inbound firewall rules change. AD CS is self-managed only. Microsoft's managed option, Intune Cloud PKI, issues certificates only to Intune-enrolled devices over SCEP, needs an add-on license, and allows up to three CAs per tenant. Docs: [Networking](https://infisical.com/docs/documentation/setup/networking), [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview). **Components to run.** Infisical is one platform, plus a gateway where it has to reach a private network. A typical AD CS deployment is an offline root CA, one or more issuing CAs, CRL and AIA publishing locations, and IIS roles for web enrollment, NDES, and the certificate enrollment web services, each with its own service accounts, certificates, and failure modes. When the offline root's CRL expires, the issuing CA stops starting until someone boots the root and republishes it. Docs: [CRL distribution](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution). **Platform scope.** Certificate Management, Secrets Management, Privileged Access Management, KMS, and agent access run on the same Infisical platform, with shared identities, audit logs, and gateway. AD CS issues certificates for Windows and Active Directory, so secrets and other security infrastructure need separate tools. Docs: [Certificate Management](https://infisical.com/docs/documentation/platform/pki/overview). ### Certificate authorities Which CAs sign public and private certificates. | Feature | Infisical | Microsoft AD CS | |---|---|---| | Private CA hierarchy | Yes | Yes | | External and public CAs | Public, private, and AD CS itself, in one inventory | Only its own CAs | **Private CA hierarchy.** Both run root and intermediate CAs. Infisical creates them in the dashboard with RSA, ECDSA, or post-quantum ML-DSA keys, can keep CA keys in an HSM through PKCS#11, and publishes CRLs and OCSP for you. In AD CS, the hierarchy is Windows servers your team builds and keeps running, often with the root kept offline. Docs: [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca), [HSM connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors). **External and public CAs.** Infisical issues from its own CAs, from AD CS itself, from any ACME CA such as Let's Encrypt, and from DigiCert, Sectigo, AWS Private CA, and Venafi, and keeps all of their certificates in one inventory. AD CS only knows its own CAs, so public certificates are tracked somewhere else. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs), [External CAs](https://infisical.com/docs/documentation/platform/pki/ca/external-ca). ### Issuance and enrollment How servers, devices, and apps request certificates. | Feature | Infisical | Microsoft AD CS | |---|---|---| | ACME | Yes | Third-party add-ons only | | EST | Yes | No | | SCEP | Any SCEP client, with built-in Intune and Jamf Pro support | Through NDES, a separate IIS role | | API | Yes | No REST API | | Linux and Kubernetes | ACME, cert-manager, or the Infisical Agent | Manual CSRs or add-ons | **ACME.** Infisical serves ACME for each application, so certbot, cert-manager, win-acme, and other ACME clients get and renew certificates on their own, including certificates issued by AD CS behind it. AD CS has no ACME support, and admins have been asking for it on public forums for years. The options are third-party add-ons or a homegrown proxy. Docs: [ACME enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme). **EST.** Infisical serves EST with certificate-based authentication and re-enrollment, for network equipment and devices. AD CS has no EST support. Docs: [EST enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/est). **SCEP.** Infisical serves SCEP directly, and validates each Microsoft Intune request with Intune before signing it. Jamf Pro works the same way. In AD CS, SCEP means NDES, a separate IIS role with its own service account, registration authority certificates that expire, and the Certificate Connector for Microsoft Intune, and a stopped application pool or an expired certificate there stops device enrollment. Docs: [SCEP enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep), [Microsoft Intune with SCEP](https://infisical.com/docs/documentation/platform/pki/guides/applications/microsoft-intune-scep), [Jamf Pro with SCEP](https://infisical.com/docs/documentation/platform/pki/guides/applications/jamf-pro-scep). **API.** Infisical issues certificates through a REST API, with machines authenticating as machine identities through Kubernetes, AWS, Azure, GCP, OIDC, and other auth methods. AD CS has no REST API. Automation goes through certreq, certutil, PowerShell, or the Windows enrollment protocols, which are hard to use from outside Windows. Docs: [API enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/api). **Linux and Kubernetes.** Linux servers get certificates from Infisical over ACME or with the Infisical Agent, which requests, stores, and renews them, and Kubernetes workloads through the Infisical cert-manager issuer. With AD CS, a Linux server's certificate usually means generating a CSR, submitting it with certreq or web enrollment, exporting a PFX, and converting it with openssl, again at every renewal. The community cert-manager issuer for AD CS is no longer maintained. Docs: [Infisical Agent for certificates](https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent), [cert-manager issuer](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer), [nginx with certbot](https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot). ### Lifecycle automation Finding, tracking, renewing, and installing certificates. | Feature | Infisical | Microsoft AD CS | |---|---|---| | Certificate discovery | Finds every certificate on your infrastructure, from any CA | No | | Inventory | One view across every CA | A database per CA, queried with certutil | | Automatic renewal | Via syncs, agents, or ACME clients | Windows autoenrollment only | | Expiry alerts | Slack, PagerDuty, email, or webhooks | None built in | | Certificate syncs | 13+ destinations, including Windows Server | Export and import by hand | **Certificate discovery.** Infisical scans domains, IP addresses, and CIDR ranges on a schedule and adds what it finds to the inventory, whoever issued it, reaching private networks through the gateway. AD CS only knows the certificates its own CAs issued. Docs: [Discovery](https://infisical.com/docs/documentation/platform/pki/discovery/overview), [Network discovery](https://infisical.com/docs/documentation/platform/pki/discovery/network). **Inventory.** Infisical keeps every certificate it issues, imports, or discovers in one inventory, filterable by application, issuer, expiry, and algorithm. AD CS keeps a database per CA, read through the Certification Authority console or queried with certutil, so there's no single view across CAs or of certificates from anywhere else. Docs: [Certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates). **Automatic renewal.** Infisical renews certificates automatically through syncs, agents, or ACME clients. Certificates enrolled through the API renew server-side before they expire and push the new ones to every sync destination. AD CS renews automatically through Group Policy autoenrollment for domain-joined Windows machines. Everything else, including Linux servers, load balancers, and templates where the requester supplies the subject, is renewed by hand or by script. Docs: [Certificate renewal](https://infisical.com/docs/documentation/platform/pki/applications/certificate-renewal). **Expiry alerts.** Infisical alerts on expiration, issuance, renewal, and revocation through email, Slack, PagerDuty, and webhooks, across every CA it manages, AD CS included. AD CS has no built-in expiry alerting, so teams write PowerShell scripts against the CA database, and expired certificates are often found when something breaks. Docs: [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview), [Slack alerts](https://infisical.com/docs/documentation/platform/pki/applications/alerting/slack-alerts). **Certificate syncs.** Infisical pushes certificates and their renewals to 13+ destinations, including Windows servers over WinRM, Linux servers, AWS Certificate Manager, AWS load balancers, Azure Key Vault, Cloudflare, F5 BIG-IP, and NetScaler, with nothing installed on the target. AD CS has no delivery outside autoenrollment, so certificates are exported and imported by hand, and cloud services like AWS Certificate Manager don't renew imported certificates for you. Docs: [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview), [Windows Server sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/windows-server). ### Access and governance Who can see and change what, access requests and approvals, and audit logs. | Feature | Infisical | Microsoft AD CS | |---|---|---| | Access control | Yes | Yes | | SAML SSO | Yes | Windows and Active Directory sign-in | | Audit logs | Yes | Windows event log, once CA auditing is on | **Access control.** Both control who can issue what. Infisical scopes roles to projects and applications, and each application has its own certificate profiles and enrollment methods. In AD CS, template permissions decide who can enroll, and a template that grants Enroll to broad groups and lets the requester supply the subject is a well-known path to privilege escalation in Active Directory, which security audits regularly flag. Docs: [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview), [Role-based access controls](https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls). **SAML SSO.** Infisical signs users in with SAML or OIDC through Okta, Microsoft Entra ID, Google, and others, as well as LDAP. AD CS administration and enrollment run on Windows and Active Directory accounts. Docs: [SSO](https://infisical.com/docs/documentation/platform/sso/overview). **Audit logs.** Infisical keeps audit logs in the platform, searchable in the dashboard, and streams them to Datadog, Splunk, Microsoft Sentinel, and other destinations. AD CS writes issuance events to the Windows Security event log once CA auditing is turned on, and collecting and searching them is up to you. Docs: [Audit logs](https://infisical.com/docs/documentation/platform/audit-logs), [Audit log streams](https://infisical.com/docs/documentation/platform/audit-log-streams/audit-log-streams). ## What you run with each ### Infisical - **Infisical platform**: The web app, API, ACME, EST, and SCEP servers, and every product, in one container image or Helm chart. On Infisical Cloud, Infisical runs it. - **PostgreSQL and Redis**: The database and cache, when self-hosting. - **gateway (where needed)**: Reaches AD CS, private networks for discovery, and sync targets, connecting out so AD CS is never exposed. - **Infisical Agent or cert-manager issuer (optional)**: Requests and renews certificates on Linux hosts and in Kubernetes. ### Microsoft AD CS - **Offline root CA**: Kept powered off, and booted to sign issuing CAs and republish its CRL before it expires. - **Issuing CAs**: Windows servers that issue certificates, each with its own CA database. - **CRL and AIA publishing**: File shares or web locations every client checks for revocation. When a CRL expires, revocation checks fail. - **Certificate templates**: Duplicated and published per use case, with permissions that decide who can enroll. - **Web enrollment**: An IIS site for requesting certificates through a browser. - **NDES and the Certificate Connector for Microsoft Intune**: An IIS role and connector for SCEP enrollment of mobile and managed devices. - **Certificate enrollment web services**: CEP and CES, IIS roles for enrolling Windows machines outside the domain. - **Group Policy autoenrollment**: Requests and renews certificates for domain-joined Windows machines. - **Scripts and add-ons**: Expiry alerts, ACME, and delivery to Linux, Kubernetes, and load balancers. ## When Microsoft AD CS is the better fit AD CS makes sense for some teams. It fits when: - Your estate is almost entirely domain-joined Windows machines, and Group Policy autoenrollment already covers what you need. - You have Windows and PKI specialists on staff who run the CAs, templates, and CRL publishing well. - Policy rules out adding any new component, even a gateway, next to your certificate authorities. - You only need certificates for Active Directory itself, such as domain controllers, smart cards, and Wi-Fi sign-in for Windows clients. ## Use Microsoft AD CS and Infisical together Infisical is a unified certificate management tool that can coexist with AD CS so you can have one source of truth for all your certificates without uprooting long-standing Windows workflows. **What stays on AD CS.** Group Policy autoenrollment for domain-joined Windows machines and your AD CS templates. **What Infisical adds.** Infisical automates what requires manual work on AD CS behind a gateway that keeps AD CS private. - A dashboard to automate discovery, alerts, renewals, and syncs for every certificate on your infrastructure - Lifecycle automation via ACME, EST, SCEP, and an API in front of AD CS templates **How the two connect.** AD CS can sign an Infisical intermediate certificate so an Infisical CA can issue new certificates your devices already trust. ## Frequently asked questions ### Is Infisical a Microsoft AD CS alternative? Yes. AD CS is a Windows Server role for issuing certificates inside an Active Directory domain. Infisical is a certificate management platform for your entire infrastructure: it runs its own root and intermediate CAs. Infisical can issue certificates over ACME, EST, SCEP, and an API to Windows, Linux, Kubernetes, and cloud workloads alike. It can also sit in front of AD CS and issue from your existing templates, so you don't have to replace it to adopt Infisical. ### Does Microsoft AD CS support ACME? No. AD CS has no native ACME or EST support, so ACME takes a third-party add-on. Infisical can also serve ACME, EST, and SCEP in front of your AD CS templates, or issue from its own CAs. ### Can I keep AD CS and use Infisical? Yes. Infisical connects to AD CS through a gateway inside your network and issues from your existing templates. AD CS can also sign an Infisical intermediate, so new certificates chain to the root your devices already trust. ### Does AD CS alert you before certificates expire? No. AD CS has no built-in expiry alerting, so teams rely on scripts or add-ons. Infisical alerts by email, Slack, PagerDuty, or webhook, across every CA it manages, AD CS included. ### How do I get AD CS certificates onto Linux and Kubernetes? AD CS has no native path for either, so teams use manual CSRs or community add-ons. With Infisical in front of AD CS, Linux servers enroll over ACME or the Infisical Agent, and Kubernetes through cert-manager. ### Is Microsoft AD CS free? AD CS comes with Windows Server licenses, so there's no separate license. The real cost is in running it: Windows servers, an offline root, IIS and NDES, the engineers who know how they fit together, and the scripts and add-ons for everything outside the domain. Infisical works out of the box for every workload, has a free tier, and offers an MIT-licensed open-source version. ### What about Microsoft Cloud PKI? Microsoft Cloud PKI issues certificates only to Intune-managed devices, over SCEP. Servers, Kubernetes, and cloud workloads are outside its scope. Infisical covers those as well as Intune devices. ## Choosing between Infisical and AD CS ### What is the best AD CS alternative for Linux and Kubernetes? Infisical issues certificates to Linux over ACME or the Infisical Agent and to Kubernetes through its cert-manager issuer, and can do it from your existing AD CS CA. AD CS itself has no native path for either, so teams fall back on manual CSRs, PFX conversions, or add-ons. Docs: [cert-manager issuer](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer). ### What is the best open-source alternative to AD CS? Infisical is an open-source certificate management platform under the MIT license, self-hosted on Docker, Kubernetes, or Linux, or used as Infisical Cloud. It runs private CAs, issues over ACME, EST, SCEP, and an API, and discovers, renews, and syncs certificates, and it can keep AD CS as a CA behind it. Docs: [Certificate Management](https://infisical.com/docs/documentation/platform/pki/overview). ### Do I have to replace AD CS to use Infisical? You don't have to replace AD CS. Infisical can issue from your AD CS templates through a gateway, or have AD CS sign an Infisical intermediate, while Group Policy autoenrollment keeps serving Windows machines in the domain. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs). ### Is AD CS hard to run? AD CS works well inside an Active Directory domain, but running it takes Windows and PKI specialists. Teams keep an offline root and its CRL current, run IIS roles for web enrollment and NDES, secure templates against privilege escalation, and script alerts and delivery for anything outside the domain. Infisical works out of the box for every workload. ### What happens when the offline root CA's CRL expires? When an offline root's CRL expires, the issuing CAs below it fail revocation checks and Certificate Services stops starting, which can take down Wi-Fi, VPN, and device enrollment. The fix is to boot the root, republish the CRL, and copy it to the distribution point. Infisical publishes CRLs for its own CAs automatically. Docs: [CRL distribution](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution). ### Is AD CS secure? AD CS is secure when it's configured carefully, but misconfigured templates are a well-documented path to privilege escalation in Active Directory, and security audits regularly flag them. The common issues are templates that grant Enroll to broad groups and let the requester supply the subject. In Infisical, certificate profiles and project roles decide who can issue what. ## Using Infisical with AD CS ### How do I add ACME to AD CS? Put Infisical in front of AD CS. Connect it through a gateway, create a Microsoft ADCS external CA, and point a certificate profile with ACME enrollment at a published template, so certbot, cert-manager, and win-acme get certificates from AD CS. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs), [ACME enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme). ### How do I issue a certificate from AD CS with Infisical? Add a Microsoft ADCS app connection with a gateway and a domain account that has Enroll on the template, create a Microsoft ADCS external CA, and attach it to a certificate profile that names the template. Requests to that profile are relayed to AD CS through the gateway and issued from the template. Docs: [Microsoft ADCS app connection](https://infisical.com/docs/integrations/app-connections/adcs). ### How do I have AD CS sign an Infisical intermediate CA? Create an intermediate CA in Infisical and install it with AD CS as the signer, using a subordinate CA template such as SubCA that allows Supply in the request. Infisical submits the CSR through the gateway, imports the signed certificate and chain, and can renew it automatically before it expires. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs). ### Which AD CS templates can Infisical use? Infisical can use any template published on the CA, as long as the connection's domain account has Enroll permission on it and the template's subject name and key usage fit the certificates you request. Infisical reads the published templates directly, so a profile can only reference one that exists. Docs: [Certificate templates](https://infisical.com/docs/documentation/platform/pki/ca/adcs). ### Does Infisical expose my AD CS server to the internet? No. Infisical reaches AD CS through a gateway that runs inside your network and connects out, so no inbound firewall rules change and the CA stays private. Docs: [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview). ### Can Infisical sign code with an AD CS certificate? Yes. A code signing signer in Infisical can request its certificate from AD CS, using a template that carries the Code Signing extended key usage. Docs: [Code signing signers](https://infisical.com/docs/documentation/platform/pki/code-signing/signers). ### How do I get alerts before AD CS certificates expire? Issue or discover the certificates through Infisical, then add an alert on the application. Infisical notifies by email, Slack, PagerDuty, or webhook before certificates expire, whether they came from AD CS or any other CA. Docs: [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview). ## Working with certificates in Infisical ### How do I issue certificates to Intune devices without NDES? Use Infisical's SCEP enrollment with the Microsoft Intune integration. Intune delivers the SCEP profile to each device, and Infisical validates every request with Intune before signing it, so there's no NDES server or IIS role to run. Docs: [Microsoft Intune with SCEP](https://infisical.com/docs/documentation/platform/pki/guides/applications/microsoft-intune-scep). ### How do I get certificates onto IIS and Windows servers without autoenrollment? Use win-acme with Infisical's ACME server for automatic issuance and renewal on IIS, or a Windows Server certificate sync, which deploys certificates over WinRM with nothing installed on the server. Docs: [Windows Server with win-acme](https://infisical.com/docs/documentation/platform/pki/guides/applications/windows-server-acme), [Windows Server sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/windows-server). ### How do I renew certificates on a Linux server automatically? Run certbot or another ACME client against your Infisical application's ACME directory, or use the Infisical Agent, which requests, stores, and renews certificates for you. Docs: [Infisical Agent for certificates](https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent). ### How do I issue Kubernetes certificates from AD CS? Install cert-manager and the Infisical Issuer, and point it at an Infisical application whose profile issues from your AD CS CA. Certificates land in Kubernetes Secrets with their chain and renew automatically. Docs: [cert-manager issuer](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer). ### How do I find every certificate on my network? Run Infisical's network discovery against your domains, IP addresses, and CIDR ranges. It adds every TLS certificate it finds to the inventory, whoever issued it, and reaches private networks through the gateway. Docs: [Network discovery](https://infisical.com/docs/documentation/platform/pki/discovery/network). ### How do I keep a CA's private key in an HSM? Add an HSM connector and choose HSM as the key source when you create the CA. The key is generated inside your HSM, and every signing operation runs there. Docs: [HSM connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors). ## Cost and Microsoft's alternatives ### Why does AD CS cost more than its license? AD CS has no separate license, but running it costs Windows servers, an offline root, IIS roles, specialist time, and the scripts and add-ons it needs outside the domain. That operating cost is usually much higher than any license. Infisical works out of the box for every workload and has a free tier. ### Can Intune Cloud PKI replace AD CS? Only for Intune-enrolled devices. Intune Cloud PKI issues over SCEP to devices enrolled in Intune, needs an add-on license, and allows up to three CAs per tenant, so servers, Kubernetes, and cloud workloads still need another CA. Infisical covers those and Intune devices. Docs: [Microsoft Intune with SCEP](https://infisical.com/docs/documentation/platform/pki/guides/applications/microsoft-intune-scep). ## Start managing certificates, then add secrets, privileged access, KMS, or agent access. - **[Secrets Management](https://infisical.com/platform/secrets-management)**: Store, rotate, and deliver secrets. - **[Certificate Management](https://infisical.com/platform/certificate-management)**: Issue, renew, and track every certificate. - **[Privileged Access Management](https://infisical.com/platform/pam)**: Time-bound access without shared credentials. - **[KMS](https://infisical.com/docs/documentation/platform/kms/overview)**: Encrypt and sign data through an API. - **[Agent Vault](https://infisical.com/platform/agent-vault)**: Give AI agents access without handing them credentials. ## How to migrate from Microsoft AD CS to Infisical Most teams start by putting Infisical in front of AD CS, then move one workload at a time. ### 1. Connect AD CS Connect AD CS to Infisical through a gateway, so your existing templates issue over ACME, EST, and SCEP. Add a Microsoft ADCS app connection with the AD CS server, a gateway inside your network, and a domain account for enrollment. Grant that account Enroll on the templates you want Infisical to use. Then create a Microsoft ADCS external CA and point a certificate profile at a published template, so ACME, EST, and SCEP clients get certificates from AD CS. Requests travel over the Windows enrollment protocol through the gateway, so AD CS is never exposed. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs), [Microsoft ADCS app connection](https://infisical.com/docs/integrations/app-connections/adcs). ### 2. Find every certificate Run discovery across your networks to see what's deployed and when it expires. Run network discovery across your domains, IP addresses, and CIDR ranges, reaching private networks through the gateway, to build one inventory of what's deployed, whoever issued it, and when each certificate expires. Docs: [Network discovery](https://infisical.com/docs/documentation/platform/pki/discovery/network). ### 3. Move one workload Point a workload at Infisical, and sync its certificates to where they're served. Create an application for a first workload outside the domain, then point its Linux servers at ACME or the Infisical Agent, or its Kubernetes cluster at the cert-manager issuer, and add certificate syncs for the load balancers and cloud services that serve it. Docs: [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview), [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview). ### 4. Chain to the AD CS root Have AD CS sign an Infisical intermediate, so new certificates chain to the root your devices already trust. Create an intermediate CA in Infisical and install it with AD CS as the signer, using a subordinate CA template such as SubCA that allows Supply in the request. Infisical generates the CSR, relays it to AD CS through the gateway, and imports the signed certificate and chain. Turn on auto-renewal, and Infisical renews the intermediate with AD CS before it expires. Docs: [Sign an intermediate with AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs), [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca). ### 5. Decide what stays Keep AD CS where you need it and move the rest to Infisical. Keep Group Policy autoenrollment on AD CS for domain-joined Windows machines for as long as it serves them. As each workload moves, retire the AD CS templates and issuing CAs it used, and keep their CRLs published until the last certificate they issued expires. Our team can help you plan and run the migration: [talk to an expert](https://infisical.com/talk-to-us). ## Get started - Start free: https://app.infisical.com/signup - Get started with Certificate Management: https://infisical.com/docs/documentation/getting-started/choose-a-product/pki - Create a private CA: https://infisical.com/docs/documentation/platform/pki/ca/private-ca - Connect Microsoft AD CS: https://infisical.com/docs/documentation/platform/pki/ca/adcs - Issue certificates over ACME: https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme - Kubernetes with cert-manager: https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer - Talk to an expert: https://infisical.com/talk-to-us - All comparisons: https://infisical.com/compare.md