In most organizations, you find a requirement for X.509 digital certificates. The organization might need an SSL certificate for a website, a server certificate for Skype for Business, or a code signing certificate as the basis for signing PowerShell scripts. Building a PKI for your organization is often an exercise in defense in depth.
A very simple design would be to make your DC an AD Certificate Services (ADCS) CA server. But that is not best practice. At a minimum, you need a single offline root CA, with a subordinate issuing CA. If you are more paranoid or have a bigger attack surface, you could consider an intermediate CA that, like the root, is offline with a third level CA that issues certificates. The richness and complexity of modern CA architecture are beyond the scope of this book.
This recipe creates a two-level CA architecture...
