Designing for a simple Cert Management using Windows 2008

Hi Guys,

We have a Single Domain, Single Forest environment..Hmm..well basically two domain for the top level domain is empty (domain.local) and all objects exists into the single child domain (my.domain.local). The current domain level is Windows 2003 R2 native.

I need to install OCS 2007 and RMS services for which I was planning to use Windows 2008 inbuilt certificate services and emulate an internal PKI.

What's involved? I have three maor site locations / offices and each office has a copy of  root and domain controllers. All site locations have their set of objects represented within an OU structure within the AD.

I have read a bit of setting up a PKI structure. A root CA and underlying CA's but I need to get a bit more clarity on that design within my current AD structure.

Would someone who has been there and done that. Throw some more light into this aspect and pass me over some helpful links, even if they be borne of 'google' search'. :)

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ParanormasticCryptographic EngineerCommented:
Most of the 'google search' documents are what I try to combat.  they usually show you the quick n dirty way to get it running that you'll probably regret 2 years later for one reason or another.

A very basic walkthrough for all the various components:

This is a decent walkthrough for a basic 2008 setup:

More info re: 2008 ADCS:

Okay, so this is written against 2003, but the concepts still apply for best practices for securing, just doesn't include new stuff in 2008 which mainly means nothing about OCSP - if you are interested in that then we can discuss that too.
ParanormasticCryptographic EngineerCommented:
I often recommend using virtual machines (VM) to keep hardware costs down.  CA stuff is not very resource intensive in general, and if your company is only 3 sites you should be fine with your standard server hardware config.  VMs make backups a snap since you can just copy the image to another drive and you're set for offsite disaster recovery.  You can use a non-routed VM network to easily transfer CRLs from the root to the online subordinate, then you can script copying the CRL to the CDP locations from there in a batch file run as a scheduled task.

When you set up your CDP & AIA locations, remember to have at least one location accessible internally and another publicly.  Even if you only issue to your employees, this will enable users working from home, laptop users, etc. to import your root cert and then you can use your own certs for internet accessible employee and partner resources, like VPN for example.  However, do not connect your CA so that it is accessible from the internet - it should be in a DMZ of some kind.  If you need a web accessible front end for some reason, 2008 provides a web server page feature that can do that while you still protect the actual CA in the DMZ.

Some useful commands:
certutil -crl     ; creates a new .crl in system32\certsrv\certenroll
certutil -crl delate    ; creates new delta crl - delta will look like filename+.crl
certutil -backupdb   ; backs up the CA database
certutil -backupkey   ; backs up the CA private key
SwiftAuthor Commented:
Thanks for the replies. One minor queru remains. As I wrote earlier that our current domain level is Windows 2003 R2 native.

If this is going to be the first server on Windows 2008, what's required? Would this me a simple member server or do I have to do some extra steps for my AD preparation before I can use 2008 for my PKI implementation?
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

ParanormasticCryptographic EngineerCommented:
You can use it just fine in your 2003R2 AD as you would a 2003 CA.  Pushing to upgrade to 2008 for the CA is not as big of a deal as it was for 2003 from 2000.  You may have difficulty using the version 3 templates, however you can make a '2003 compatible' template for v2.  Both v2 and v3 templates make v3 certs, v1 templates make v1 certs (v2 was pretty much skipped over).

The biggest thing in v3 certs is support for the newer CNG algorithms like ECDSA, ECDH, and the SHA-2 suite.  However, unless you are running a purely vista/2008 and newer environment you will need to deploy a number of hotfixes for that stuff to even work and 2048 RSA is still just fine.

Here is a good base link for more information:
SwiftAuthor Commented:

I am facing conceptual issues and haven't been able to resolve them despite some reading, I'm sure you can help.

The needs of this Cert management infrastructure were two: namely: OCS 2007 which needs TLS certificates for both server to server and client to server communications AND Office 2007 information Rights management implmentation.

If I take one thing at a time and make things easier for me: I'll take Office communications server (OCS).

First I need to generate certificate for the OCS servers that maybe the easy part.

There is a client aspect, called as , Microsoft Office Communicator R2 client and is just like Instant Messenger. When I deploy this client on my workstation XP machines, I need to automatically initiate a certificate request to the PKI to create a public key cert for the associated OCS server's private key.

How would I automate this process?
ParanormasticCryptographic EngineerCommented:
Sorry, been a little busy lately...  Hopefully you have already found what you were looking for

Use a certificate template and you can use the Autoenroll permission for the appropriate groups (in addition to read and enroll).  this will automate the process.  You may wish to have certificate manager approval on the template for the first issuance and not require that on renewals - or not, depending on the level of security you are looking for.

Here's an article that discusses more - hopefully that helps with that.

Some stuff on RFS as related to certs, etc.:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.