1. One the Server Manager Dashboard screen, under Configure this local server, click Add roles and features.
2. Click Next three times to get to the server role selection screen.
3. On the Select Server Roles page, select Active Directory Certificate Services, click Add Features when prompted, and then click Next.
4. Click Next three times to accept the default settings, and then click Install.
5. Wait for the installation to complete.
6. In the Installation Progress dialog, click the Configure Active Directory Certificate Services on the destination server link.
7. On the Credentials screen, click Next.
8. On the Role Services page, select Certification Authority, and click Next.
9. Click Next seven times to accept the default configuration options for Enterprise Root CA.
10. On the confirmation screen, click Configure.
11. Verify that configuration succeeded, and click Close.
12. Click Close in the Add Roles and Features Wizard.

 Windows PowerShell equivalent commands

The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints.

Install-WindowsFeature AD-Certificate -IncludeManagementTools

Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -Force

1. On DC1, from the Start screen, click Group Policy Management.
2. In the console tree, open Forest: corp.contoso.com\Domains\corp.contoso.com.
3. In the console tree, right-click Default Domain Policy, and then click Edit.
4. In the console tree of the Group Policy Management Editor, open Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies.
5. In the details pane, double-click Certificate Services Client – Auto-Enrollment. In Configuration Model, select Enabled.
6. Select Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificate templates. Click OK.

7.   Close Group Policy Management Editor and Group Policy Management Console.

1. On APP1, from the Start screen, click Certification Authority.
2. In the details pane, expand corp-APP1-CA.
3. Right-click Certificate Templates and select Manage.
4. In the Certificate Templates console, right-click Workstation Authentication and click Duplicate Template.
5. On the General tab, change the Template display name to Client-Server Authentication and select Publish certificate in Active Directory.
6. On the Extensions tab, click Application Policies and then click Edit. Click Add, and then select Server Authentication. Click OK twice to return to the Properties of New Template dialog.
7. Click the Security tab. For Domain Computers, select the checkbox to Allow Autoenroll. Click OK. Close the Certificate Templates Console.
8. In the Certification Authority snap-in console tree, right-click Certificate Templates and select New then Certificate Template to Issue.
9. Select Client-Server Authentication and then click OK.
10. Close the Certification Authority console.