Designing for a simple Cert Management using Windows 2008

Posted on 2009-07-02
Last Modified: 2013-11-29
Hi Guys,

We have a Single Domain, Single Forest environment..Hmm..well basically two domain for the top level domain is empty (domain.local) and all objects exists into the single child domain (my.domain.local). The current domain level is Windows 2003 R2 native.

I need to install OCS 2007 and RMS services for which I was planning to use Windows 2008 inbuilt certificate services and emulate an internal PKI.

What's involved? I have three maor site locations / offices and each office has a copy of  root and domain controllers. All site locations have their set of objects represented within an OU structure within the AD.

I have read a bit of setting up a PKI structure. A root CA and underlying CA's but I need to get a bit more clarity on that design within my current AD structure.

Would someone who has been there and done that. Throw some more light into this aspect and pass me over some helpful links, even if they be borne of 'google' search'. :)

Question by:fahim
  • 4
  • 2
LVL 31

Expert Comment

ID: 24765388
Most of the 'google search' documents are what I try to combat.  they usually show you the quick n dirty way to get it running that you'll probably regret 2 years later for one reason or another.

A very basic walkthrough for all the various components:

This is a decent walkthrough for a basic 2008 setup:

More info re: 2008 ADCS:

Okay, so this is written against 2003, but the concepts still apply for best practices for securing, just doesn't include new stuff in 2008 which mainly means nothing about OCSP - if you are interested in that then we can discuss that too.
LVL 31

Expert Comment

ID: 24765707
I often recommend using virtual machines (VM) to keep hardware costs down.  CA stuff is not very resource intensive in general, and if your company is only 3 sites you should be fine with your standard server hardware config.  VMs make backups a snap since you can just copy the image to another drive and you're set for offsite disaster recovery.  You can use a non-routed VM network to easily transfer CRLs from the root to the online subordinate, then you can script copying the CRL to the CDP locations from there in a batch file run as a scheduled task.

When you set up your CDP & AIA locations, remember to have at least one location accessible internally and another publicly.  Even if you only issue to your employees, this will enable users working from home, laptop users, etc. to import your root cert and then you can use your own certs for internet accessible employee and partner resources, like VPN for example.  However, do not connect your CA so that it is accessible from the internet - it should be in a DMZ of some kind.  If you need a web accessible front end for some reason, 2008 provides a web server page feature that can do that while you still protect the actual CA in the DMZ.

Some useful commands:
certutil -crl     ; creates a new .crl in system32\certsrv\certenroll
certutil -crl delate    ; creates new delta crl - delta will look like filename+.crl
certutil -backupdb   ; backs up the CA database
certutil -backupkey   ; backs up the CA private key

Author Comment

ID: 24779683
Thanks for the replies. One minor queru remains. As I wrote earlier that our current domain level is Windows 2003 R2 native.

If this is going to be the first server on Windows 2008, what's required? Would this me a simple member server or do I have to do some extra steps for my AD preparation before I can use 2008 for my PKI implementation?
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

LVL 31

Expert Comment

ID: 24818425
You can use it just fine in your 2003R2 AD as you would a 2003 CA.  Pushing to upgrade to 2008 for the CA is not as big of a deal as it was for 2003 from 2000.  You may have difficulty using the version 3 templates, however you can make a '2003 compatible' template for v2.  Both v2 and v3 templates make v3 certs, v1 templates make v1 certs (v2 was pretty much skipped over).

The biggest thing in v3 certs is support for the newer CNG algorithms like ECDSA, ECDH, and the SHA-2 suite.  However, unless you are running a purely vista/2008 and newer environment you will need to deploy a number of hotfixes for that stuff to even work and 2048 RSA is still just fine.

Here is a good base link for more information:

Author Comment

ID: 24999043

I am facing conceptual issues and haven't been able to resolve them despite some reading, I'm sure you can help.

The needs of this Cert management infrastructure were two: namely: OCS 2007 which needs TLS certificates for both server to server and client to server communications AND Office 2007 information Rights management implmentation.

If I take one thing at a time and make things easier for me: I'll take Office communications server (OCS).

First I need to generate certificate for the OCS servers that maybe the easy part.

There is a client aspect, called as , Microsoft Office Communicator R2 client and is just like Instant Messenger. When I deploy this client on my workstation XP machines, I need to automatically initiate a certificate request to the PKI to create a public key cert for the associated OCS server's private key.

How would I automate this process?
LVL 31

Accepted Solution

Paranormastic earned 500 total points
ID: 25283894
Sorry, been a little busy lately...  Hopefully you have already found what you were looking for

Use a certificate template and you can use the Autoenroll permission for the appropriate groups (in addition to read and enroll).  this will automate the process.  You may wish to have certificate manager approval on the template for the first issuance and not require that on renewals - or not, depending on the level of security you are looking for.

Here's an article that discusses more - hopefully that helps with that.

Some stuff on RFS as related to certs, etc.:

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
In-place Upgrading Dirsync to Azure AD Connect
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question