The architecture of a XenDesktop 7.x environment is based upon the use of internal certificates. For internal use, for example for the connection of the StoreFront Server with the Desktop Delivery Controller, one would prefer not be forced to use certificates that need to be changed every year. The standard setting of Microsoft CA for web server certificates is exactly one year. Additionally we will show that a Microsoft CA can be installed using PowerShell.
The Microsoft CA can be attached to every Windows server system via Windows rolls. Certificates can be very easily created with the CA that are valid for one year, for example. In accordance with new requirements almost all data paths in terminal server environments today are being encrypted. Thus even communication with the Citrix STA should occur with encryption. Currently the Microsoft CA offers certificates for two years as standard. It is possible however to create one's own template in order to generate longer multiyear certificates. Here we will describe how to achieve this. First the installation of Microsoft CA with PowerShell. A few settings must absolutely be confirmed. This configuration is good for the creation of a quick certificate. This can also be done in a test environment and thereafter the certificates can be imported into the production environment onto only those servers where they are needed. However no CA should be installed for the entire infrastructure of a company in such a manner. A CA for email encryption requires careful planning. The root certificate of the installation will be replicated automatically in Active Directory. It is thus available after some time on all domain members (server/client). It is recommended to keep the validity period of the root shorter, in the event of critical security problems.