> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft ADCS Connection

> Learn how to configure a Microsoft ADCS Connection for Infisical certificate management.

Connect Infisical to Microsoft Active Directory Certificate Services (AD CS) through an Infisical [Gateway](/documentation/platform/gateways/overview). The Gateway runs inside your network and communicates with the CA directly, so your AD CS server never needs to be exposed to the internet.

## Prerequisites

* A Microsoft Active Directory Certificate Services (AD CS) server (Enterprise CA)
* An Infisical [Gateway](/documentation/platform/gateways/overview) deployed inside the network that can reach the AD CS server
* A domain account with Enroll permission on the certificate templates you plan to use (and Manage CA / Certificate Manager rights if you want to revoke certificates)
* Network reachability from the Gateway to the AD CS server on:
  * **TCP 135** (RPC endpoint mapper) and the server's **dynamic RPC port range** (default `49152-65535`) for MS-WCCE/MS-CSRA over DCOM
  * **TCP 445** (SMB) only if you rely on automatic CA-name discovery (reads the CA name over the Remote Registry service)

## Connection Setup

<Steps>
  <Step title="Navigate to App Connections">
    Navigate to the **App Connections** tab on the **Organization Settings** page.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png" alt="App Connections Tab" />
  </Step>

  <Step title="Add Connection">
    Select the **Microsoft ADCS Connection** option from the connection options modal.
  </Step>

  <Step title="Configure Connection Details">
    * **Name**: Friendly name for this connection (for example, `production-adcs`)
    * **CA Host**: The AD CS server hostname or IP reachable from the Gateway (for example, `ca01.corp.example.com`)
    * **Username**: Domain account in the form `DOMAIN\username` or `username@domain.com`
    * **Password**: Password for the domain account
    * **Gateway**: The Gateway that can reach the AD CS server

    A Gateway is required. The control plane cannot reach AD CS over DCOM directly, so every operation is relayed through the Gateway.
  </Step>

  <Step title="Connection Created">
    Your **Microsoft ADCS Connection** is now available for use.
  </Step>
</Steps>