asked on

How to implement PKI CA on windows 2008 server?

we are trying to install PKI CA on our windows 2008 server but we are unable to locate caconfig.inf file. where can i find this file and how can i configure settings on it. We have already installes IIS and CA in roles. Please help us in this matter.
Thanks.

Rajeev

Paranormastic

You need to create one in Notepad. See the code snippet for an example.

Technically the capolicy.inf is optional - but without it you get default settings that may not be desirable.

Before using the example, you would need to enable the new algorithm set on the CA:
certutil -setreg ca\csp\DiscreteSignatureAlgorithm 1
net stop certsvc & net start certsvc

You will need to make sure these patches are rolled out to your XP/2003 boxes:
KB922706
KB938397
KB948963

Reading material:
http://download.microsoft.com/download/4/7/f/47f81ee5-8593-4b39-871d-2f55eb731ad6/Certificate%20Services%20Enhancements%20in%20Longhorn%20Server.doc

Version]
Signature="$Windows NT$"
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1 ; Server Authentication
OID = 1.3.6.1.5.5.7.3.2 ; Client Authentication
OID = 1.3.6.1.5.5.7.3.3 ; Code Signing
OID = 1.3.6.1.5.5.7.3.4 ; Secure Email
OID = 1.3.6.1.5.5.7.3.5 ; IP security end system
OID = 1.3.6.1.5.5.7.3.6 ; IP security tunnel termination
OID = 1.3.6.1.5.5.7.3.7 ; IP security user
OID = 1.3.6.1.5.5.7.3.8 ; Time Stamping
OID = 1.3.6.1.5.5.7.3.9 ; OCSP Signing
[certsrv_server]
renewalkeylength=4096
RenewalValidityPeriodUnits=20
RenewalValidityPeriod=years
CRLPeriod=weeks
CRLPeriodUnits=26
CRLOverlapPeriod=weeks
CRLOverlapUnits=2
CRLDeltaPeriodUnits=0
CRLDeltaPeriod=days
DiscreteSignatureAlgorithm=1

Open in new window

Paranormastic

note: there should be an opening [ before Version...

Globrin

ASKER

hi,

i want to configure the PKI CA in windows 2008 server that is domain controler please help me

Regards,

Rajeeve

Globrin

ASKER

HI,

Our basic requrement is configure ssl and smart Card in windows 2008, please guide us

Regards

Rajeeve Jose

ASKER CERTIFIED SOLUTION

Paranormastic

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Globrin

ASKER

Hi
i am installed CA in standalone windows 2008 but how to run the scrip step 10 please advice me

Regards

Rajeeve Jose

Paranormastic

The code snippet isn't a script. Copy and paste it (with the opening [ I accidentally left out) into notepad and save as capolicy.inf in the c:\windows (%systemroot%) directory, then install AD CS.