In theory a root Certificate Authority in the Windows world should be a simple thing:
* Click some buttons and install the Certificate Authority components;
* Run a wizard and enter the name of the CA and possibly other details.
Maybe there'd be a third step sometimes, such as:
* Copy some vaguely named file to an improbably named directory.
In practice, however, building a reasonably secure CA hierarchy that doesn't require significant maintenance is a royal pain in the rear.
In this series of articles I document how I build a production-quality root CA and the accompanying CA hierarchy....