Find the certificate authority in an Active Directory domain

certutil -config - -ping lists the enterprise CAs published in Active Directory and checks that the one you pick is responding.

  • Updated
  • 1 min read

In an Active Directory domain, the certificate authority (CA) issues the certificates that authenticate users, devices and applications. When you troubleshoot a certificate problem, the first question is often which server the CA runs on.

The command

certutil -config - -ping

certutil is built into Windows. With -config -, it opens a dialog that lists the CAs published in Active Directory, with the server each one runs on. -ping then checks that the CA you select is online and answering requests.

The ping only tells you whether the CA service responds. It does not check the CA’s own certificate.

Join the discussion

Comments are hosted on comments.vciso.ch, a server I run myself. Nothing is loaded from it until you press the button below. Loading comments connects your browser to that server, and signing in with GitHub sets a cookie there. See the privacy page for details.

Type to search.

↑ ↓ to move, Enter to open, Esc to close