|Managing Active Directory Certificates / Exporting the Active Directory SSL Certificate|
You can request the root CA certificate for the Active Directory server by going to the CA web enrollment site for the server.
To request the root CA certificate from the web enrollment site:
ip_address is the root CA server IP address
fqdn is the fully-qualified domain name of the root CA server