Preparation If you are not the Enterprise domain administrator, you will need to work with that person to get the correct domain permissions to generate a sub CA. Install the OpenSSL toolkit (www.openssl.org) on a Windows or Linux machine.