Install the Entrust Proxy for Microsoft CA, as explained in the following sections.

System requirements for the Entrust Proxy for Microsoft CA

To install the Entrust Proxy for Microsoft CA, you need a machine with Windows Server 2016 (x64) or above.

Creating a Proxy Admin account

Create a Proxy Admin user belonging to the Cert Publishers and Domain User groups.

To create a proxy admin user

1. Press Win + R to open the Run dialog.
2. Type dsa.msc and press Enter.
3. Select Users under the Windows domain
4. In the right pane, double-click on mscaproxyadm.
   
5. Create a Proxy Admin user
6. Add the users only to the Cert Publishers and Domain User groups.

Configuring the Windows domain account

Configure the Windows login account of the Entrust Proxy for Microsoft CA. See below for the supported combinations when the Entrust Proxy for Microsoft CA and the Domain Controller share the same server or run on different servers.

In either case, enable only the following user permissions.

• Issue and Manage Certificates
• Request Certificates
• Read

Adding the Windows domain account to the logon as a service policy

Add the new Windows account to the Logon as a service policy.

To add the Windows domain account to the logon as a service policy

1. Press Windows + R to open the Run window.
2. Type secpol.msc and press Enter.
3. In the Local Security Policy window, navigate to Local Policies > User Rights Assignment.
4. In the right pane, double-click on Log on as a service.
5. Click Add User or Group,
6. Select the account created in the previous section, Creating a Proxy Admin account
7. .
8. Click OK,
9. Click Apply.

Installing Java

Install Java on the machine that will host the Entrust Proxy for Microsoft.

To install Java

1. Log in using the account created in the previous section, Creating a Proxy Admin account.
2. Install one of the following LTS (Long Term Support) Java distributions.
   • Oracle Java x86_64 version 17
   • OpenJDK 17
   • AdoptOpenJDK 17
3. Set the ​JAVA_HOME environment to the Java installation path.
4. Extend the value of the PATH environment variable to: 
   %JAVA_HOME%\bin
5. Run the following command to check the Java version and architecture details. 
   java -XshowSettings:properties -version

Downloading the Entrust Proxy for Microsoft CA installer

Download and extract the Entrust Proxy for Microsoft CA installer files.

To download the Entrust Proxy for Microsoft CA installer

1. Log in trustedcare.entrust.com
2. Go to PRODUCTS > Cryptographic Security Platform
3. Select the latest version.
4. Click the download link of the Entrust Proxy for Microsoft CA.
5. Unzip the compressed file contents to your selected installation directory on the Windows machine – for example, in c:\mscaproxy 

   Installing into c:\Program Files may not be functional due to Windows privilege enforcement.

Configuring logs

Optionally, edit the configuration files to modify the default log recording settings.

For example, adding the following code to the config\application.yml file sets the log level to INFO.

Running the Entrust Proxy for Microsoft CA installer

See below for running the Entrust Proxy for Microsoft CA installer and registering the Entrust Proxy for Microsoft CA as a Windows service.

To run the Entrust Proxy for Microsoft CA installer

1. Log in to a Windows machine as the Proxy Admin user (created in section Creating a Proxy Admin account).
2. Run the following command.
   
   MSCAProxy.exe install /p
3. When prompted, type the <domainName> domain name and the <proxyAdminUserName> Proxy Admin username. Supported formats are:
   • ​User Principal Name (UPN) – for example: ​<domainName>@<proxyAdminUserName>
   • The  Down-Level Logon Name – for example: <domainName>\<proxyAdminUserName>
4. Type the password of the Proxy Admin user.
5. Type "y" to allow the log-on as a service. 

   The installer does not wait for you to press the Enter key.

Uninstalling the Entrust Proxy for Microsoft CA 

Run the following command as an administrator in case you want to uninstall the Entrust Proxy for Microsoft CA.