Active Directory Certificate Services

Purpose¶

This document outlines the Microsoft-recommended best practices for deploying a secure, internal-use-only, two-tier Public Key Infrastructure (PKI) using Windows Server 2022 or newer. The PKI supports securing S/MIME email, 802.1X Wi-Fi with NPS, and LDAP over SSL (LDAPS).

Offline (Non-Domain-Joined) Root CA LAB-CA-01¶

Role Deployment¶

This is the initial deployment of the root certificate authority, the settings here should be double and triple checked before proceeding through each step.

• Provision a non-domain-joined Windows Server
  • This is critical that this device is not domain-joined for security purposes
• Navigate to "Server Manager > Manage > Add Roles and Features"
  • Check "Active Directory Certificate Services"
    • When prompted to confirm, click the "Add Features" button
    • Ensure the "Include management tools (if applicable)" checkbox is checked.
  • Click "Next" > "Next" > "Next"
    • You will be told that the name of the server cannot be changed after this point, and it will be associated with WORKGROUP > This is fine and you can proceed.
  • Check the boxes for the following role services:
    • Certification Authority
    • Certification Authority Web Enrollment
      • When prompted to confirm multiple times, click the "Add Features" button
      • Ensure the "Include management tools (if applicable)" checkbox is checked.
        • There are additional steps such as Configure AIA and CDP extensions with HTTP paths and Publish root cert and CRL to AD and internal HTTP, but these do not apply to an LDAPS-only deployment, and are more meant for websites / webhosting. (current understanding)
  • Click "Next" > "Next" > "Next" > "Install"
  • Restart the Server

Role Configuration¶

We have a few things we need to configure within the CA to make it ready to handle certificate requests.

• Navigate to "Server Manager > (Alert Flag) > Post-deployment Configuration: Active Directory Certificate Services"
  • You will be prompted for an admin user, in this example, you will use the pre-populated LAB-CA-01\Administrator
  • Check the boxes for Certification Authority and Certification Authority Web Enrollment then click "Next"
  • Check the "Standalone CA" radio box then click "Next"
  • Check the "Root CA radio box then click "Next"
  • Check the "Create a new private key" radio box then click "Next"
  • Click the dropdown menu for "Select a crypotographic provider" and ensure that "RSA#Microsoft Software Key Storage Provider" is selected
    • Microsoft Software Key Storage Provider (KSP) is the latest, most flexible provider designed to work with the Cryptography Next Generation (CNG) APIs. It offers better support for modern algorithms and improved security management (such as support for key attestation, better hardware integration, and improved key protection mechanisms).
  • Set the key length to 4096
  • Set the hash algorithm to SHA256
  • Click "Next"
  • Common Name for this CA: BunnyLab-RootCA
  • Distinguished name suffix: O=Bunny Lab,C=US
  • Preview of distinguished name: CN=BunnyLab-RootCA,O=Bunny Lab,C=US
  • Click "Next"
  • Specify the validity period: 10 Years then click "Next" > "Next" > "Configure"

You will see a finalization screen confirming everything we have configured, it should look something like what is seen below:

Online (Domain-Joined) Subordinate/Intermediary CA LAB-CA-02¶

Role Deployment¶

Now that we have set up the root certificate authority, we can focus on setting up the subordinate CA.

• Navigate to "Server Manager > (Alert Flag) > Post-deployment Configuration: Active Directory Certificate Services"
  • Under credentials, enter the username for an Enterprise Admin. (e.g. BUNNY-LAB\nicole.rappe)
  • Click "Next"
  • Check the following roles (we will add the rest after setting up the core CA functionality)
    • Certification Authority
    • Certification Authority Web Enrollment
  • Check the "Enterprise CA" radio box then click "Next"
  • Check the "Subordinate CA" radio box then click "Next"
  • Check the "Create a new private key" radio box then click "Next"
  • Click the dropdown menu for "Select a crypotographic provider" and ensure that "RSA#Microsoft Software Key Storage Provider" is selected
    • Microsoft Software Key Storage Provider (KSP) is the latest, most flexible provider designed to work with the Cryptography Next Generation (CNG) APIs. It offers better support for modern algorithms and improved security management (such as support for key attestation, better hardware integration, and improved key protection mechanisms).
  • Set the key length to 4096
  • Set the hash algorithm to SHA256
  • Click "Next"
  • Common Name for this CA: BunnyLab-SubordinateCA-01
  • Distinguished name suffix: DC=bunny-lab,DC=io
    • This will be auto-filled based on the domain that the CA is joined to
  • Preview of distinguished name: CN=BunnyLab-SubordinateCA-01,DC=bunny-lab,DC=io
  • Click "Next"
  • Select the "Save a certificate request to file on the target machine" radio button
    • This will auto-populate the destination to something like "C:\LAB-CA-02.bunny-lab.io_bunny-lab-LAB-CA-02-CA.req"
  • Click "Next" > "Next" > "Configure"

You will see a finalization screen confirming everything we have configured, it should look something like what is seen below:

Role Configuration¶

At this point, we will need to focus on getting the certificate signing request generated on LAB-CA-02 to LAB-CA-01 (the rootCA), this can be via temporary network access or via a USB flashdrive.

• Once the certificate signing request file C:\LAB-CA-02.bunny-lab.io_bunny-lab-LAB-CA-02-CA.req is on LAB-CA-01 (RootCA) we can proceed to get it signed.
• Navigate to "Server Manager > Tools > Certification Authority"
  • Right-click the CA node in the treeview on the left-hand sidebar (e.g. BunnyLab-RootCA)
  • Click on "All Tasks" > "Submit new request..."
    • Browse to and select the subordinate CA’s .req file (e.g. LAB-CA-02.bunny-lab.io_bunny-lab-LAB-CA-02-CA.req)
  • Click on "BunnyLab-RootCA > Pending Requests
  • Right-click the request we just imported, and select "All Tasks > Issue"
  • Click on ""BunnyLab-RootCA > Issued Certificates"
    • Locate the new subordinate CA certificate, and double-click it.
    • Click the "Details" tab
    • Click the "Copy to File" button
      • Click "Next"
      • Choose DER encoded binary X.509 (.CER) and save as LAB-CA-02-SubCA.cer.
  • Export the Root CA certificate:
    • Right-click the BunnyLab-RootCA node > Properties > View Certificate > Details > Copy to File...
    • Save as RootCA.cer
• Copy both LAB-CA-02-SubCA.cer (the signed subordinate CA cert) and RootCA.cer (the root CA cert) to the subordinate CA (LAB-CA-02), using a secure method (e.g. USB drive).
• On LAB-CA-02 (Subordinate CA), Navigate to "Server Manager > Tools > Certification Authority"
  • Right-click the CA node in the treeview on the left-hand sidebar (e.g. BunnyLab-SubordinateCA-01)
  • Click on "All Tasks" > "Install CA Certificate"
    • Browse to and select LAB-CA-02-SubCA.cer (you may need to change the cert file extension filter to X.509 Certificate)
    • When prompted for the CA chain or root certificate, browse for and select the RootCA.cer you transferred earlier along with the LAB-CA-02-SubCA.cer
    • Launch certsrv.msc to open the [Certificates - Local Computer] management window
      • Right-Click "Trusted Root Certification Authorities" > All Tasks > Import
        • Click "Next"
        • Browse to the BunnyLab-RootCA.crl located on \\LAB-CA-01\CertEnroll\BunnyLab-RootCA.crl (if the RootCA is temporarily on the network) or copy the file manually via USB drive from C:\Windows\System32\certsrv\CertEnroll\BunnyLab-RootCA.crl
        • Place all certificates in the following store: "Trusted Root Certification Authorities"
        • Click "Next" and finish importing the Certificate Revocation List
  • Right-click the CA node in the treeview on the left-hand sidebar (e.g. BunnyLab-SubordinateCA-01)
  • Click on "All Tasks" > "Start Service"
  • Verify that the CA status is now green (running).

Certificate Template Permissions¶

Lastly, we need to adjust the security permissions of the "Domain Controller Authentication" template so that domain controllers have read permissions to the template.

• Right-Click ""Certificate Templates" > Manage
  • Right-click "Domain Controller Authentication" > Properties
  • Click on the "Security" tab
  • Under the "Domain Controllers" permission, ensure that "Allow:Read" is checked, as well as "Enroll" and "Autoenroll", then click "OK"
    • Repeat the above step except for the "Domain Controller" certificate template's properties instead.

Create Auto-Enrollment Group Policy¶

The Certificate Auto-Enrollment Group Policy enables domain-joined devices (computers, including domain controllers) to automatically request, renew, and install certificates from the Enterprise CA (in this case, the Subordinate CA LAB-CA-02).

Create GPO¶

• Open the Group Policy Management editor on one of your domain controllers, then "Create a GPO in this domain, and link it here" wherever it will be able to target the domain controllers, this may be at the root, or in a specific OU that holds domain controllers. (e.g. bunny-lab.io\Domain Controllers )
  • Name the new GPO something like "Certificate Auto-Enrollment"
  • Edit the GPO
    • Navigate to "Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies"
    • Find and open "Certificate Services Client - Auto-Enrollment."
      • Set the Configuration Model to "Enabled"
      • Check both checkboxes for "Renew expired certificates, update pending certificates, and remove revoked certificates" and "Update certificates that use certificate templates"
      • Click "OK"
    • Navigate to "Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities"
      • Right-click the "Trusted Root Certification Authorities" folder and select "Import..." > Proceed to browse for the RootCA.cer that you previously generated. (copy it to the domain controller if needed from one of the Certificate Authorities)
      • Proceed to import the certificate, clicking-through all of the prompts and confirmations until it finishes the import.
    • Navigate to "Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Intermediate Certification Authorities"
      • Right-click the "Trusted Root Certification Authorities" folder and select "Import..." > Proceed to browse for the LAB-CA-02-SubCA.cer that you previously generated. (copy it to the domain controller if needed from one of the Certificate Authorities)
      • Proceed to import the certificate, clicking-through all of the prompts and confirmations until it finishes the import.
• Run a gpupdate /force on your domain controller(s) and give it a few minutes to pull down their new domain controller certificates

Validate Auto-Enrollment Functionality¶

At this point, you need to check that there is a certificate installed within "Certificates - Local Computer > Personal > Certificates" for "Domain Controller Server Authentication"

• Load the Certificate - Local Machine (certlm.msc) and navigate to "Personal > Certificates" > You should see something similar to the following:

Validate LDAPS Connectivity¶

Lastly, we want to ensure that LDAPS is functioning. By default, once these certs are enrolled on the domain controller(s), LDAPS should just work out of the box. To verify this, you can run this command on any device on the same network as the domain controllers. If it comes back successful like in the following example output, then you are golden:

PS C:\Users\nicole.rappe> Test-NetConnection LAB-DC-01.bunny-lab.io -Port 636                                                                                                                                                                                               
ComputerName     : LAB-DC-01.bunny-lab.io                                                                                             
RemoteAddress    : 192.168.3.25
RemotePort       : 636
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.3.254
TcpTestSucceeded : True

PS C:\Users\nicole.rappe> Test-NetConnection LAB-DC-02.bunny-lab.io -Port 636
ComputerName     : LAB-DC-02.bunny-lab.io
RemoteAddress    : 192.168.3.26
RemotePort       : 636
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.3.254
TcpTestSucceeded : True