Microsoft PKI – Single Tier Server (Graphical Setup)

If you have not already read the first page in this MS PKI series, 
you should do so before continuing.

The following is useful for setting up a single ADCS PKI server in a very small environment such as a lab. It provides instructions using the standard graphical interface that most people use in the MS world. It uses LDAP for all publishing the CDP/AIA points to computers that are only on the domain.

 If HTTP is needed to publish CRL/AIA, it must be on a different server (Maybe, I’ve had issues getting CRL/AIA publishing to work on the same server).  The requirements can be used from the “Two Tier” setup instructions located on a different page.

Note that a single tier PKI is not typically appropriate in a production environment.

A second page is provided elsewhere that uses a mixture of command line instructions, both PowerShell and the certutil interfaces, for building and configuring the server.

Build up the server and add to the domain.

Copy CAPolicy.inf to C:\windows  (%systemroot%) of root CA server. A simple minimal example is provided below. You must do this step prior to installing the CA role.

Warning:  If creating a new replacement issuing (including single tier) server, use the CAPolicy.inf with the “LoadDefaultTemplates=0” line added.  When server is ready to issue, manually add the certificate templates.

CAPolicy.inf example for Root CA:

[Version]
Signature=”$Windows NT$”
  
[Certsrv_Server]
RenewalKeyLength=4096 
RenewalValidityPeriod=Years 
RenewalValidityPeriodUnits=20 
 
[CRLDistributionPoint] 
  
[AuthorityInformationAccess] 

Install CA Role:

Enterprise root CA
"Certification Authority"

Configure ADCS:

"Certification Authority"
"Enterprise CA"
"Root CA"
"Create Private Key"   -- RSA default is ok,key length 4096, SHA256
"Common name"          -- Not the same name as the server
"Validity period"      -- Should be set by CAPolicy.inf, or equal to.

After complete, check the certificate with MMC CertSRV.  It should match above settings.

Post Install Configuration:

Open command prompt as administrator. Don’t make these too short if using LDAP. Consider OCSP instead.

NOTE: There are many settings. These are pretty minimal.

Certutil -setreg CA\CRLPeriodUnits 1 
Certutil -setreg CA\CRLPeriod "Weeks" 
    --Next two if CRL Deltas are used (which I usually don't on single tier testing server) 
Certutil -setreg CA\CRLDeltaPeriodUnits 1 
Certutil -setreg CA\CRLDeltaPeriod "Days"

Add the CDP and AIA points:

From Server Manager:

"Tools" 
"Certification Authority" (MMC CertSRV) 
"Properties" 
"Extensions" tab

Don’t screw these up or you have to start over because issued certs will be bad.

Add CDP (CRL Distibution Point):

Click ADD, use as examples and add LDAP path utilizing “Variable” and Insert.

 

ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>

Check "Publish CRL's to this location","Include in CRL's", "Include in the CDP extentions of issued certificates"

Remove default ones except C:\windows (standalone - so no file, ldap, anyway) 
    -- or -- 
Uncheck all boxes for each. 

Add AIA  (Authority Information Access):

Click ADD, use as examples and add LDAP path utilizing “Variable” and Insert.

ldap:///CN=<CATruncatedName>,CN=AIA,CN=Public Key Services,CN=Services,<ConfigurationContainer><CAObjectClass>

Check "Include in the AIA of issued certificates"

Remove default ones except "C:\windows\System32\CertSrv\CertEnroll\<ServerDNSName>_<CaName><CertificateName>.crt
   -- or -- 
Uncheck all "Publish/Include" boxes for each. 

Restart the Service and Publish CRL (certutil -crl):

Restart certificate services to activate this configuration in a PowerShell window:

restart-service certsvc
R-click "Revoked Certificates"
All Tasks, Publish

C:\Windows\System32\CertSrv\CertEnroll – .crl’s date modified should change when CRL is published.

Check PKI health:

pkiview

Also check “Manage AD Containers” from the pkiview menu.

If CA Object Access Auditing is needed, see the page here.

Microsoft PKI – PKI Health (pkiview)

pkiview.msc is a graphical tool that helps immensely with checking the overall function of your Microsoft PKI setup.

Use pkiview.msc:

PowerShell (as admin), type the following:

pkiview

Up front, it is pretty explanatory. You will see if something is not correct in your setup.

Also, view the CA containers in AD:

R-click "Enterprise PKI" 
"Manage AD Containers"
Check each tab to see if everything is functioning OK.

Microsoft PKI – Two Tier Configuration

If you have not already read the first page in this MS PKI series, 
you should do so before continuing.

It is suggested that you read through all of this article prior to doing anything. In fact, you should understand what a “two-tier” PKI is and how it is used before continuing.

The instructions below are broken into two main parts. The first main part is for the root CA server and the second main part is for the issuing servers. Note that issuing server(s) is plural, but only one set of instructions are provided. You must adapt the instructions to each additional server that you build.

Note also that within both sections are configuration items that involve setting up IIS for the CRL/AIA points. You should build the IIS server out as a separate server, not as part of the issuing server as I have done here (to save time and VM resources in my test environment).

Root CA server configuration

Install and setup the base server – BUT DO NOT place it on domain. Also, you cannot change the server name after the role is installed!

Example CAPolicy.inf:

Create and copy CAPolicy.inf BEFORE installing role. “RenewalValidityPeriodUnits” and “CRLPeriodUnits” should be high as this is for a rootCA and it will be offline unless needed.

[Version] 
Signature="$Windows NT$" 
[Certsrv_Server] 
RenewalKeyLength=4096 
RenewalValidityPeriod=Years 
RenewalValidityPeriodUnits=10
CRLPeriod=Years 
CRLPeriodUnits=10
AlternateSignatureAlgorithm=0 
[CRLDistributionPoint] 
[AuthorityInformationAccess]

Copy the CAPolicy.inf to C:\windows  (%systemroot%) of root CA server.

Install CA Role:

Standalone root CA (i.e. - not on domain)
"Certification Authority" only.

RootCA – Configure ADCS:

 "Certification Authority"
 "Standalone CA"
 "Root CA"
 "Create Private Key"
  RSA default is ok, key length 4096, SHA256
 Common name
 "Validity period" - should be set by CAPolicy.inf, or equal to. 

After this is complete, check the certificate with MMC CertSRV.  It should match above settings.

 "Server Manger", "Tools", "Certification Authority"
      R-click CA, "Properties", "General" tab, "View Certificate" 

You must do the following (CDP and AIA) before issuing subordinate certificates!

Don’t screw these up or you have to start over because issued root certificates will be bad.

In other words – plan ahead for ALL the required servers! Again, see the top of this page.

NOTE:  I have seen it stated that the AIA/CDP information should not be established on the root server. We will do it here because the MS examples set it up.

 "Server Manger", "Tools", "Certification Authority" (or MMC CertSRV - same thing)
      R-click CA, "Properties", "Extensions" tab 

Add CDP (CRL Distibution Point):

 Click ADD, use as examples and add HTTP path utilizing "Variable" and Insert.
      http://pki.contoso.com/pki/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
 
Check "Include in CRL's", "Include in the CDP extentions of issued certificates"
Remove default ones except C:\windows\... (standalone - so no file, ldap, anyway), or uncheck all boxes for each. 

Add AIA  (Authority Information Access):

 Click ADD, use as examples and add HTTP path utilizing "Variable" and Insert.
      http://pki.contoso.com/pki/<ServerDNSName>_<CAName><CertificateName>.crt

 Check "Include in the AIA of issued certificates"
 Remove default ones except C:\windows\... (standalone - so no file, ldap, anyway), or uncheck all boxes for each. 

Publish CRL (certutil -crl):

 R-click "Revoked Certificates"
 All Tasks, Publish

 CD to C:\Windows\system32\certsrv\certenroll
 Copy the CRL and root certificate to c:\pki on subordinate servers (store on usb drive/share to do that later) 

Publish Root Certificate to AD:

 Copy the root certificate to a domain joined server such as the issuing server.
      Open PowerShell terminal as admin.
           certutil -dspublish -f <name>.crt RootCA 


Issuing (subordinate) server configuration

NOTE:  IIS is recommended as the distribution point for the CRL Distribution Point (CDP) and the Authority Information Access (AIA) point. It should typically be a separate server, possibly in the DMZ, depending on the PKI requirements.  Here I am installing it on the issuing server, but this is not recommended.  This can also create problems when later moving to a new PKI system, so just be aware of that.

Subordinate CA’s – Intermediate (policy) and/or issuing CA’s.   Enterprise (on domain) or standalone. We will place ours on the domain.

Setup base server – Place on domain and name it. You cannot change the server name after the role is installed!

Add Root Certificate and Root CRL to the issuing server’s local store:

NOTE: Not totally necessary but this is supposed to help with issuing server setup that follows. Otherwise, the root cert can be obtained via GPO and the root CRL via CDP location if both are configured.

Copy the root certificate and root CRL to the domain joined issuing server.
 
Open PowerShell terminal as admin.
 certutil -addstore -f root <name>.crt
 certutil -addstore -f root <name>.crl 

NOTE: Not sure if this is necessary or helpful, but I do it anyhow:

Install ROOT-CA certificate on subordinate server:

 D-click ROOT-CA certificate, "Install Certificate". "Local Machine",
      "Place all Certificates in the following store", select "Trusted Root Certification Authority"

 Check in browser that rootCA certificate shows up in the certificate store. 

Create DNS cname for the following in DNS server:

 pki.contoso.com  --> issuingca.contoso.com 

Install the IIS Role:

Should be obvious to a MS admin.

Setup CDP and AIA distribution point directory for web access:

Create directory: C:\pki
      New-Item -Path C:\pki -type directory

Create a share:
      New-SmbShare -Name pki -Path C:\pki -FullAccess SYSTEM,"contoso\Domain Admins" -ChangeAccess "contoso\Cert   Publishers"
  
Copy ROOT-CA certificate and Certificate Revocation List to C:\pki 

In IIS – Setup a Virtual Directory:

Sites, r-click "Default Web Site", "Add Virtual Directory"
      Alias = "pki"
      Physical path = "c:\pki"
 
Select "pki", "Edit permissions", Security tab, edit
      Grant access to "anonymous logon", "Everyone" (read and list)
 
"Request Filtering", "Edit Feature Settings",  
      Check "Allow Double Escaping"
 
Restart IIS 

Example CAPolicy.inf:

“RenewalValidityPeriodUnits” cannot be higher than on the rootCA

 [Version]  
 Signature="$Windows NT$"  
 [Certsrv_Server]  
 RenewalKeyLength=4096  
 RenewalValidityPeriod=Years  
 RenewalValidityPeriodUnits=9
 AlternateSignatureAlgorithm=0
 LoadDefaultTemplates=0 
 [CRLDistributionPoint]  
 [AuthorityInformationAccess] 

Copy CAPolicy.inf to C:\windows  (%systemroot%) of the server.

Install CA Role:

NOTE: If you need other roles such as “Certification Authority Web Enrollment” (I don’t yet cover these other roles in the blog), also do them now.

 "Active Directory Certificate Services"
 "Certification Authority"
     Read descriptions for others you may need. 

Configure ADCS Subordinate (Issuing):

What you chose above may also affect the choices here.

 Select "Certification Authority"
 "Enterprise CA"
 "Subordinate CA"
 "Create Private Key"
 RSA default is ok, key length 4096, SHA256
 Common name
 "Request a certificate from parent CA":
      If rootCA online, choose "Send a certificate request to parent CA"
      If rootCA offline, choose "Save a certificate request to file on target machine"
 Finish configuration wizard steps 

Copy the issuing server request to the rootCA.

In root CA MMC certsrv:

 R-click "ROOT-CA", "All Tasks", "Submit new request", select request file
 Open "Pending Requests", R-click, "All tasks", "Issue"
 Open "Issued Certificates", R-click, "Open", "Details", "Copy to file", (.P7B)" 

Copy certificate back to subordinate CA server.

In the issuing server MMC certsrv:

 R-click CA server, "All Tasks", "Install CA Certificate", select certificate
 From C:\pki, copy ROOT-CA certificate and Certificate Revocation List to C:\Windows\system32\certsrv\certenroll
 R-click CA server,  "All Tasks", "Start Service" 

Post Install Configuration:

Set CDP (this is all in one command):

 certutil -setreg CA\CRLPublicationURLs "65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10\n6:http://pki.contoso.com/pki/%3%8%9.crl\n65:file://\\cert-issue.contoso.com\pki\%3%8%9.crl" 

Set AIA (this is all in one command):

 certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11\n2:http://pki.contoso.com/pki/%1_%3%4.crt" 

Additional settings from the command line as administrator: *Set short for testing only*

 Certutil -setreg CA\CRLPeriodUnits 2
 Certutil -setreg CA\CRLPeriod "Days"
 Certutil -setreg CA\CRLDeltaPeriodUnits 1
 Certutil -setreg CA\CRLDeltaPeriod "Days"
 Certutil -setreg CA\CRLOverlapPeriodUnits 3
 Certutil -setreg CA\CRLOverlapPeriod "Hours"
 Certutil -setreg CA\ValidityPeriodUnits 5
 Certutil -setreg CA\ValidityPeriod "Years" 

Copy Issuing CA Certificate to C:\pki AIA Location:

 Copy "C:\Windows\System32\certsrv\certenroll\< Issuing CA Cert>.crt" to C:\pki\ 

Restart service and publish CRLs:

restart-service certsvc
 
certutil -crl 

Check AIA and CDP PKI health:

 MMC, add snapin "Enterprise PKI" (pkiview.msc)
      AIA location "OK"
      CDP location "OK" 

View AIA and CDP settings:

 certutil -getreg CA\CACertPublicationURLs
 certutil -getreg CA\CRLPublicationURLs
      -or-
 Open "Tools", "Certification Authority" (MMC CertSRV), "Properties", "Extensions" tab