[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now


Designing for a simple Cert Management using Windows 2008

Posted on 2009-07-02
Medium Priority
Last Modified: 2013-11-29
Hi Guys,

We have a Single Domain, Single Forest environment..Hmm..well basically two domain for the top level domain is empty (domain.local) and all objects exists into the single child domain (my.domain.local). The current domain level is Windows 2003 R2 native.

I need to install OCS 2007 and RMS services for which I was planning to use Windows 2008 inbuilt certificate services and emulate an internal PKI.

What's involved? I have three maor site locations / offices and each office has a copy of  root and domain controllers. All site locations have their set of objects represented within an OU structure within the AD.

I have read a bit of setting up a PKI structure. A root CA and underlying CA's but I need to get a bit more clarity on that design within my current AD structure.

Would someone who has been there and done that. Throw some more light into this aspect and pass me over some helpful links, even if they be borne of 'google' search'. :)

Question by:fahim
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
LVL 31

Expert Comment

ID: 24765388
Most of the 'google search' documents are what I try to combat.  they usually show you the quick n dirty way to get it running that you'll probably regret 2 years later for one reason or another.

A very basic walkthrough for all the various components:

This is a decent walkthrough for a basic 2008 setup:

More info re: 2008 ADCS:

Okay, so this is written against 2003, but the concepts still apply for best practices for securing, just doesn't include new stuff in 2008 which mainly means nothing about OCSP - if you are interested in that then we can discuss that too.
LVL 31

Expert Comment

ID: 24765707
I often recommend using virtual machines (VM) to keep hardware costs down.  CA stuff is not very resource intensive in general, and if your company is only 3 sites you should be fine with your standard server hardware config.  VMs make backups a snap since you can just copy the image to another drive and you're set for offsite disaster recovery.  You can use a non-routed VM network to easily transfer CRLs from the root to the online subordinate, then you can script copying the CRL to the CDP locations from there in a batch file run as a scheduled task.

When you set up your CDP & AIA locations, remember to have at least one location accessible internally and another publicly.  Even if you only issue to your employees, this will enable users working from home, laptop users, etc. to import your root cert and then you can use your own certs for internet accessible employee and partner resources, like VPN for example.  However, do not connect your CA so that it is accessible from the internet - it should be in a DMZ of some kind.  If you need a web accessible front end for some reason, 2008 provides a web server page feature that can do that while you still protect the actual CA in the DMZ.

Some useful commands:
certutil -crl     ; creates a new .crl in system32\certsrv\certenroll
certutil -crl delate    ; creates new delta crl - delta will look like filename+.crl
certutil -backupdb   ; backs up the CA database
certutil -backupkey   ; backs up the CA private key

Author Comment

ID: 24779683
Thanks for the replies. One minor queru remains. As I wrote earlier that our current domain level is Windows 2003 R2 native.

If this is going to be the first server on Windows 2008, what's required? Would this me a simple member server or do I have to do some extra steps for my AD preparation before I can use 2008 for my PKI implementation?
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 31

Expert Comment

ID: 24818425
You can use it just fine in your 2003R2 AD as you would a 2003 CA.  Pushing to upgrade to 2008 for the CA is not as big of a deal as it was for 2003 from 2000.  You may have difficulty using the version 3 templates, however you can make a '2003 compatible' template for v2.  Both v2 and v3 templates make v3 certs, v1 templates make v1 certs (v2 was pretty much skipped over).

The biggest thing in v3 certs is support for the newer CNG algorithms like ECDSA, ECDH, and the SHA-2 suite.  However, unless you are running a purely vista/2008 and newer environment you will need to deploy a number of hotfixes for that stuff to even work and 2048 RSA is still just fine.

Here is a good base link for more information:

Author Comment

ID: 24999043

I am facing conceptual issues and haven't been able to resolve them despite some reading, I'm sure you can help.

The needs of this Cert management infrastructure were two: namely: OCS 2007 which needs TLS certificates for both server to server and client to server communications AND Office 2007 information Rights management implmentation.

If I take one thing at a time and make things easier for me: I'll take Office communications server (OCS).

First I need to generate certificate for the OCS servers that maybe the easy part.

There is a client aspect, called as , Microsoft Office Communicator R2 client and is just like Instant Messenger. When I deploy this client on my workstation XP machines, I need to automatically initiate a certificate request to the PKI to create a public key cert for the associated OCS server's private key.

How would I automate this process?
LVL 31

Accepted Solution

Paranormastic earned 2000 total points
ID: 25283894
Sorry, been a little busy lately...  Hopefully you have already found what you were looking for

Use a certificate template and you can use the Autoenroll permission for the appropriate groups (in addition to read and enroll).  this will automate the process.  You may wish to have certificate manager approval on the template for the first issuance and not require that on renewals - or not, depending on the level of security you are looking for.

Here's an article that discusses more - hopefully that helps with that.

Some stuff on RFS as related to certs, etc.:

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question