Configuring and Using Active Directory Certificate Services (part 1) - Finalizing the Configuration of an Issuing CA

Log on to an issuing CA with a domain account that has local administrative rights.

Launch the Certification Authority console from the Administrative Tools program group.

Right-click the issuing CA name and click Properties.

In the Properties dialog box, click the Extensions tab and verify that the Select Extension drop-down list is set to CRL Distribution Point (CDP). Also make sure that the Publish CRLs To This Location and the Publish Delta CRLs To This Location check boxes are selected.

Click OK.

If you made any changes to the CA’s configuration, you are prompted to stop and restart the AD CS service. Click Yes to do so.

On the issuing CA, open an elevated command prompt and execute the following commands:

certutil -setreg ca\CRLOverlapUnits value
certutil -setreg ca\CRLOverlapPeriod units
certutil -setreg ca\CRLDeltaOverlapUnits value
certutil -setreg ca\CRLDeltaOverlapPeriod units

Value is the value you want to use to set the overlap period, and units is minutes, hours, or days. For example, you could set the CRL overlap period to 24 hours and the Delta CRL publication period to 12 hours. For this, you would use the following commands:

certutil -setreg ca\CRLOverlapUnits 24
certutil -setreg ca\CRLOverlapPeriod hours
certutil -setreg ca\CRLDeltaOverlapUnits 12
certutil -setreg ca\CRLDeltaOverlapPeriod hours

Go to the Certification Authority console and right-click the issuing CA server name to stop and restart the service.

In the Certification Authority console, expand the console tree below the issuing CA server name.

Right-click Revoked Certificates and click Properties.

On the CRL Publishing Parameters tab, configure the CRL and Delta CRL publication periods.

By default, both values are set to one week and one day, respectively. If you expect to have a high throughput of certificates and need to ensure high availability of the CRLs, decrease both values. If not, keep the default values.

You can also view existing CRLs on the View CRLs tab.

Click OK.

Log on to an issuing CA, using domain administrative credentials.

Launch Server Manager from the Administrative Tools program group.

Expand Roles\Active Directory Certificate Services and select Certificate Templates (servername).

Note that all the existing templates are listed in the details pane.

Warning:

IMPORTANT UPGRADING CERTIFICATE AUTHORITIES

If you are upgrading an existing CA infrastructure to Windows Server 2008 R2, the first time you log on to a new server running AD CS, you are prompted to update the existing certificate templates. Answer Yes. This upgrades all templates to Windows Server 2008 R2 versions.

Note that you are connected to a DC by default.

To work with templates, you must be connected to a DC so that the templates can be published to AD DS.

If you are not connected, use the More Actions\Connect To Another Writable Domain Controller command in the Action pane to connect to a DC.

You are ready to create the templates you require.

Select the source template, right-click the template, click Duplicate Template, and then select the version of Windows Server to support.

This should always be Windows Server 2008 unless you are running in a mixed PKI hierarchy.

Name the new template, customize it, and save the customizations.

Customize templates according to the following guidelines:

• To create an EFS template, select the Basic EFS template as the source, duplicate it for Windows Server 2008, and name it. Use a valid name, such as Basic EFS WS08, and then move through the property tabs to customize its content. Pay particular attention to key archival on the Request Handling tab, and make sure you select the Archive Subject’s Encryption Private Key check box. Also, use encryption to send the key to the CA. Archival storage of the private key allows you to protect it if the user ever loses it. You can also use the Subject Name tab to add information such as Alternate Subject Name values. Click OK.

• If you plan to use EFS, you must also create an EFS Recovery Agent template. Duplicate it for Windows Server 2008. Name it with a valid name such as EFS Recovery Agent WS08. Publish the recovery agent certificate in Active Directory by selecting the Publish Certificate In Active Directory checkbox. Note that the recovery agent certificate is valid for a much longer period than the EFS certificate itself. Also, use the same settings on the other property tabs as you assigned to the Basic EFS duplicate.
  

• If you plan to use wireless networks, create a Network Policy Server (NPS) template for use with your systems. Basically, you create the template and configure it for autoenrollment. Then, the next time the NPS servers in your network update their Group Policy settings, they will be assigned new certificates. Use the RAS and IAS Server templates as the sources for your new NPS template. Duplicate it for Windows Server 2008. Name it appropriately, such as NPS Server WS08. Publish it in Active Directory. On the Security tab, select the RAS and IAS Servers group to assign the Autoenroll and Enroll permissions. Review other tabs as needed and save the new template.

• If you want to use smart card logons, create duplicates of the Smartcard Logon and Smartcard User templates. Set the duplicates for Windows Server 2008. Name them appropriately and publish them in Active Directory. You do not use Autoenrollment for these certificates because you need to use smart card enrollment stations to distribute the smart cards to the users.

• If you want to protect web servers or DCs, create duplicates of the Web Server and Domain Controller Authentication templates. Do not use the Domain Controller template; it is designed for earlier versions of the operating system. Duplicate them for Windows Server 2008, publish them in Active Directory, and verify their other properties.

Note:

CONFIGURING DUPLICATE TEMPLATES

The configuration of each template type often includes additional activities that are not necessarily tied to AD CS. Make sure you view the AD CS online help to review the activities associated with the publication of each certificate type.

Now that your templates are ready, you must issue the template to enable the CA to issue certificates based on these customized templates.

In Server Manager, expand Roles\Active Directory Certificate Services\Issuing CA Name and select Certificate Templates.

To issue a template, right-click Certificate Templates, point to New, and then click Certificate Template To Issue.

In the Enable Certificate Templates dialog box, shown in Figure 1, hold down the Ctrl key and click to select all the templates you want to issue, and then click OK.

Log on to a DC, and then launch Group Policy Management from the Administrative Tools program group.

Locate or create the appropriate policy, right-click it, and then click Edit.

To assign autoenrollment for computers, expand Computer Configuration\Policies\Windows Settings\Security Settings and select Public Key Policies.

Double-click Certificate Services Client – Auto-Enrollment.

Enable the policy and select the Renew Expired Certificates, Update Pending Certificates, And Remove Revoked Certificates check box.

Select the Update Certificates That Use Certificate Templates check box if you have already issued some certificates manually. Click OK to assign these settings.

To assign autoenrollment for users, expand User Configuration\Policies\Windows Settings\Security Settings and select Public Key Policies.

Enable the Certificate Services Client – Auto-Enrollment policy and select the same options as for computers.

Notice that you can enable Expiration Notification for users. Enable it and set an appropriate value.

Users will be notified when their certificates are about to expire.

Click OK to assign these settings.

Warning:

IMPORTANT COMPUTER AND USER GROUP POLICY SETTINGS

Normally, you should not apply both user and computer settings in the same Group Policy object. This is done here only to illustrate the settings you need to apply to enable autoenrollment.

Close the GPMC.

Return to the issuing CA and move to Server Manager to set the default action that your issuing CA will use when it receives certificate requests.

Right-click the issuing CA server name under AD CS and click Properties.

On the Policy Module tab, click Properties.

To have certificates issued automatically, select Follow The Settings In The Certificate Template, If Applicable. Otherwise, Automatically Issue The Certificate. Click OK.

Click OK again to close the Properties dialog box.