Designing for a simple Cert Management using Windows 2008

Posted on 2009-07-02
Medium Priority
Last Modified: 2013-11-29
Hi Guys,

We have a Single Domain, Single Forest environment..Hmm..well basically two domain for the top level domain is empty (domain.local) and all objects exists into the single child domain (my.domain.local). The current domain level is Windows 2003 R2 native.

I need to install OCS 2007 and RMS services for which I was planning to use Windows 2008 inbuilt certificate services and emulate an internal PKI.

What's involved? I have three maor site locations / offices and each office has a copy of  root and domain controllers. All site locations have their set of objects represented within an OU structure within the AD.

I have read a bit of setting up a PKI structure. A root CA and underlying CA's but I need to get a bit more clarity on that design within my current AD structure.

Would someone who has been there and done that. Throw some more light into this aspect and pass me over some helpful links, even if they be borne of 'google' search'. :)

Question by:fahim
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
LVL 31

Expert Comment

ID: 24765388
Most of the 'google search' documents are what I try to combat.  they usually show you the quick n dirty way to get it running that you'll probably regret 2 years later for one reason or another.

A very basic walkthrough for all the various components:

This is a decent walkthrough for a basic 2008 setup:

More info re: 2008 ADCS:

Okay, so this is written against 2003, but the concepts still apply for best practices for securing, just doesn't include new stuff in 2008 which mainly means nothing about OCSP - if you are interested in that then we can discuss that too.
LVL 31

Expert Comment

ID: 24765707
I often recommend using virtual machines (VM) to keep hardware costs down.  CA stuff is not very resource intensive in general, and if your company is only 3 sites you should be fine with your standard server hardware config.  VMs make backups a snap since you can just copy the image to another drive and you're set for offsite disaster recovery.  You can use a non-routed VM network to easily transfer CRLs from the root to the online subordinate, then you can script copying the CRL to the CDP locations from there in a batch file run as a scheduled task.

When you set up your CDP & AIA locations, remember to have at least one location accessible internally and another publicly.  Even if you only issue to your employees, this will enable users working from home, laptop users, etc. to import your root cert and then you can use your own certs for internet accessible employee and partner resources, like VPN for example.  However, do not connect your CA so that it is accessible from the internet - it should be in a DMZ of some kind.  If you need a web accessible front end for some reason, 2008 provides a web server page feature that can do that while you still protect the actual CA in the DMZ.

Some useful commands:
certutil -crl     ; creates a new .crl in system32\certsrv\certenroll
certutil -crl delate    ; creates new delta crl - delta will look like filename+.crl
certutil -backupdb   ; backs up the CA database
certutil -backupkey   ; backs up the CA private key

Author Comment

ID: 24779683
Thanks for the replies. One minor queru remains. As I wrote earlier that our current domain level is Windows 2003 R2 native.

If this is going to be the first server on Windows 2008, what's required? Would this me a simple member server or do I have to do some extra steps for my AD preparation before I can use 2008 for my PKI implementation?
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

LVL 31

Expert Comment

ID: 24818425
You can use it just fine in your 2003R2 AD as you would a 2003 CA.  Pushing to upgrade to 2008 for the CA is not as big of a deal as it was for 2003 from 2000.  You may have difficulty using the version 3 templates, however you can make a '2003 compatible' template for v2.  Both v2 and v3 templates make v3 certs, v1 templates make v1 certs (v2 was pretty much skipped over).

The biggest thing in v3 certs is support for the newer CNG algorithms like ECDSA, ECDH, and the SHA-2 suite.  However, unless you are running a purely vista/2008 and newer environment you will need to deploy a number of hotfixes for that stuff to even work and 2048 RSA is still just fine.

Here is a good base link for more information:

Author Comment

ID: 24999043

I am facing conceptual issues and haven't been able to resolve them despite some reading, I'm sure you can help.

The needs of this Cert management infrastructure were two: namely: OCS 2007 which needs TLS certificates for both server to server and client to server communications AND Office 2007 information Rights management implmentation.

If I take one thing at a time and make things easier for me: I'll take Office communications server (OCS).

First I need to generate certificate for the OCS servers that maybe the easy part.

There is a client aspect, called as , Microsoft Office Communicator R2 client and is just like Instant Messenger. When I deploy this client on my workstation XP machines, I need to automatically initiate a certificate request to the PKI to create a public key cert for the associated OCS server's private key.

How would I automate this process?
LVL 31

Accepted Solution

Paranormastic earned 2000 total points
ID: 25283894
Sorry, been a little busy lately...  Hopefully you have already found what you were looking for

Use a certificate template and you can use the Autoenroll permission for the appropriate groups (in addition to read and enroll).  this will automate the process.  You may wish to have certificate manager approval on the template for the first issuance and not require that on renewals - or not, depending on the level of security you are looking for.

Here's an article that discusses more - hopefully that helps with that.

Some stuff on RFS as related to certs, etc.:

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question