Install the Entrust Proxy for Microsoft CA, as explained in the following sections.

System requirements for the Entrust Proxy for Microsoft CA

To install the Entrust Proxy for Microsoft CA, you need a machine with Windows Server 2016 (x64) or above.

Creating a Proxy Admin account

Create a Proxy Admin user and add it only to the Cert Publishers and Domain User groups.

Configuring the Windows domain account

Configure the Windows login account of the Entrust Proxy for Microsoft CA. See below for the supported combinations when the Entrust Proxy for Microsoft CA and the Domain Controller share the same server or run on different servers.

User

Service startup type

Same server

Different servers

A local service account

Automatic or Automatic (Delayed Start)

(tick) 

(tick) 

A domain user

Automatic (Delayed Start)

(tick) 

(error) 

In either case, enable only the following user permissions.

  • Issue and Manage Certificates
  • Request Certificates
  • Read

Installing Java

On the machine that will host the Entrust Proxy for Microsoft:

  1. Log in using the account created in the previous section, Creating a Proxy Admin account.
  2. Install one of the following LTS (Long Term Support) Java distributions.
    • Oracle Java x86_64 version 17
    • OpenJDK 17
    • AdoptOpenJDK 17
  3. Set the ​JAVA_HOME environment to the Java installation path.
  4. Extend the value of the PATH environment variable to: 
    %JAVA_HOME%\bin
  5. Run the following command to check the Java version and architecture details. 
    java -XshowSettings:properties -version

Downloading the Entrust Proxy for Microsoft CA installer

Download and extract the Entrust Proxy for Microsoft CA installer files.

To download the Entrust Proxy for Microsoft CA installer

  1. Log in trustedcare.entrust.com
  2. Go to PRODUCTS > Cryptographic Security Platform
  3. Select the latest version.
  4. Click the download link of the Entrust Proxy for Microsoft CA.
  5. Unzip the compressed file contents to your selected installation directory on the Windows machine – for example, in c:\mscaproxy 

    Installing into c:\Program Files may not be functional due to Windows privilege enforcement.

Configuring logs

Optionally, edit the configuration files to modify the default log recording settings.

Configuration file

Parameter

Value

​MSCAProxy.xml

​logpath

​The folder where to save logs.

config\application.yml

com.entrust.mscaproxy

The supported log levels. Supported values in increasing severity are TRACE, DEBUG, INFO, WARN, ERROR, FATAL and OFF.

If you edit these pages after starting Entrust Proxy for Microsoft, run the MSCAProxy.exe restart command to restart it.

For example, adding the following code to the config\application.yml file sets the log level to INFO.

logging:
level:
root: INFO
com.entrust.mscaproxy: INFO

Running the Entrust Proxy for Microsoft CA installer

See below for running the Entrust Proxy for Microsoft CA installer and registering the Entrust Proxy for Microsoft CA as a Windows service.

To run the Entrust Proxy for Microsoft CA installer

  1. Log in to a Windows machine as the Proxy Admin user (created in section Creating a Proxy Admin account).
  2. Run the following command.
    MSCAProxy.exe install /p
  3. When prompted, type the <domainName> domain name and the <proxyAdminUserName> Proxy Admin username. Supported formats are:
    • ​User Principal Name (UPN) – for example: ​<domainName>@<proxyAdminUserName>
    • The  Down-Level Logon Name – for example: <domainName>\<proxyAdminUserName>
  4. Type the password of the Proxy Admin user.
  5. Type "y" to allow the log-on as a service. 

    The installer does not wait for you to press the Enter key.

Uninstalling the Entrust Proxy for Microsoft CA 

Run the following command as an administrator in case you want to uninstall the Entrust Proxy for Microsoft CA.

MSCAProxy.exe uninstall