?
Solved

Certification Authority

Posted on 2003-12-11
4
Medium Priority
?
702 Views
Last Modified: 2010-04-14
Hi,

I've implement Certification Authority within our network and have a few questions.

If I open the MMC for Cert Authority and look at Issued Certicates I can see that Certificates have been automatically issued to all clients and servers except DC's, is this normal?

Also, the main reason that I installed this was so that I could create a certificate to be used with a remote VPN using L2TP but haven't been able to figure out how to do this yet.  Any help would be great.

Since having this service installed I've notice a noticable increase in speed when accessing network resources!!!

Thanks in advance.
0
Comment
Question by:ukking
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 10

Accepted Solution

by:
KingHollis earned 1000 total points
ID: 9926904
ukking,

Is this a Windows 2003 environment?
In Windows 2003, machine [computer] certificate auto-enrollment is configured by default. In Window 2000 you have to manually configure this in a GPO. Navigate to the Default Domain Policy GPO-->Computer Configuration-->Windows Settings-->Security Settings-->Public Key Policies-->Automatic Certificate Request Policies. Here you should see Computer to indicate computer certs are auto-issued. Right-mouse click, select New-->Automatic Certificate Request-->Domain Controllers. You will need to refresh the policy in order to get the DC to initiate the enrollment. Domain controllers should get a Domain Controller certificate. If the CA is a DC, it will have two-- one for the CA and one DC one. Create a MMC snap-in and select Certificates for local machine--then look under Personal->Certificates and you should see them.

The long and short of setting up L2TP VPNs is it is merely a PPTP VPN with IPSec policies enabled. So, once you run through the wizard to set up your VPN [one calling and one answering] selecting the "Use L2TP first then PPTP", you merely set up an IPSec policy to enforce the use of IPSec when initiating communications with the other location. You can make this as specific as just PPTP traffic or all traffic. I suggest you set it up to require encryption for all traffic--makes testing easier [even pings will initiate the IPSec communication]. Initially, configure your IPSec policy to use a preshared key [a password] to authenticate the connection to test it. Once you are certain it works [use ipsecmon.exe to view it], then you can edit the policy to use the certificate issued to your machines. Just make sure that both machines have computer certificates from the same certificate authority or root.

So, here are useful links with the details of what I explained:
Setting up Site-to-site VPN [PPTP]
http://www.microsoft.com/downloads/details.aspx?FamilyID=7424168e-f745-4450-b671-aac2c79568eb&DisplayLang=en

Setting up IPSec
http://www.microsoft.com/downloads/details.aspx?FamilyID=7424168e-f745-4450-b671-aac2c79568eb&DisplayLang=en

Hope this helps.
Best of luck!
0
 

Author Comment

by:ukking
ID: 9928656
Sorry,

Windows 2000.  I've seen this Q before and I couldn't use it with windows 2000.
0
 

Author Comment

by:ukking
ID: 9928730
Sorry should read the WHOLE question before answering.

That's excellent!!!

Thanks very much.
0
 
LVL 10

Expert Comment

by:KingHollis
ID: 9928771
No worries! Anything to help fellow royalty.

Thanks for your consideration.
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Hey fellow admins! This time, I have a little fairy tale for you. As many tales do, it starts boring and then gets pretty gory. I hope you like it. TL;DR: It is about an important security matter, you should read it if you run or administer Windows …
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question